Cybersecurity

Application Security PodCast

---

---

Steve Wilson--OpenClaw and Advanced AI Agents

In this episode of the Application Security Podcast, Chris Romeo and Robert Hurlbut welcome back Steve Wilson, a global leader in AI security and Chief AI and Product Officer at Exabeam, as well as founder of the OWASP Gen AI Security Project.Steve shares how his AI assistant was hacked using a simple phishing attack, highlighting a major shift in securityAI agents behave more like humans than traditional software. The conversation explores how this changes the threat model, why AppSec is struggling to keep up, and how organizations should approach the practical security of AI systems.They also cover the risks of...

Brad Geesaman - Redefining AppSec with AI: Shrinking Toil, Expanding Impact - How LLMs are able to reduce toil in triage-heavy AppSec workflows

Brad Geesaman, Principal Security Engineer at Ghost, joins the podcast today to explore how AI and large language models are transforming the world of application security. The discussion starts with the concept of "toil"the repetitive, exhausting work that drains AppSec teams as they struggle to keep up with mountains of security findings and alerts. Brad shares his insights on how LLMs can provide meaningful leverage by handling the heavy lifting of triage, classification, and evidence gathering, while keeping humans firmly in the loop for final decisions. They also discuss the seismic shift happening in the AppSec market, with AI-native approaches...

OWASP Candidate Debate - 2025 Edition

In this special episode of the Application Security Podcast we meet nine of the OWASP Board of Directors candidates. Each candidate discusses their unique qualifications, experiences, and vision for OWASP's future. Topics include enhancing OWASP's impact, improving outreach and education, securing funding, and engaging local chapters. Don't miss this insightful debate as these candidates share their strategies to help secure a brighter future for OWASP.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Francesco Cipollone - Agentic AI Manifesto

Francesco Cipollone, the CEO of Phoenix Security, shares his extensive experience in AI and security, discussing the crucial difference between true AI agents and glorified chatbots. Learn why Phoenix Security utilizes six different LLMs instead of a single super agent. Understand the sobering economics behind AI implementation and the importance of adopting AI responsibly. Get practical advice on integrating AI agents to enhance, not replace, human capabilities, while touching on the Agentic AI Manifesto's key principles. This conversation is perfect for anyone navigating the AI landscape both cautiously and optimistically.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for...

Simon Gibbs & Devika Gibbs -- Building Bridges with Games

Simon and Devika Gibbs, the innovative minds behind Cybersec Games, join us on the episode today. Discover how the Gibbs duo are revolutionizing the way we teach and learn security concepts through interactive gaming. Learn about their journey from developing stationary for agile teams to delving into the world of threat modeling games like Elevation of Privilege. We talk about the power of gamification in cybersecurity education, and get the inside scoop on their Cybersecurity Game Challenge, which invites creative minds to bring their game ideas to life.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Akansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps

Our guest today is Akansha Shukla, an information security professional with over 10 years of experience in application security, DevSecOps, and API security. Were discussing why API security remains one of the least mature areas of AppSec today and exploring the challenges developers face when securing APIs. Akansha shares her insights on incorporating APIs into threat modeling exercises, the ongoing struggles with API discovery and inventory management, and the authorization challenges highlighted in the OWASP API Security Top 10. The conversation also touches on whether "shift left" is truly dead and why we still haven't solved basic security problems like...

Getting Ready for the EU CRA

The European Union's Cyber Resilience Act is set to revolutionize how we approach product security worldwide. In this episode, we sit down with application security expert Nariman Aga-Tagiyev to break down everything you need to know about this legislation. Nariman has over 20 years of software development experience and today hes sharing his expertise with us. Learn what the EU CRA is and why it matters for global software companies, key compliance requirements, and how OWASP SAMM can help you.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Marisa Fagan - Measuring Security Culture

Marisa Fagan, Head of Product at Katilyst and veteran security culture expert joins us today to share practical strategies for building and scaling security champions programs that actually work, from designing effective pilots to avoiding common pitfalls that can derail your initiatives. Learn how to motivate developers using the SAPs model (Status, Access, Power, Stuff), why getting management buy-in is crucial before launching, and discover the metrics that truly demonstrate security culture success. Marisa reveals why most programs fail, shares her blueprint for creating sustainable security culture initiatives, and discusses the evolution beyond security champions to include privacy and accessibility...

Aram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics

Aram Hovsepyan joins the podcast today to chat about the misconceptions behind common security metrics. Aram tells us how total vulnerability counts and CVSS scores can be misleading and he introduces us to the Goal Question Metric framework, this framework is a better approach to building truly effective security dashboards. Learn about the critical qualities of good metrics and how to ensure that your metrics accurately reflect your organization's security posture and readiness. Also, discover overlooked metrics that could offer deeper insights into your application security.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Sean Varga -- OWASP Top 10 for AppSec Sales

Were discussing the intersections of application security (AppSec) and sales strategy with our guest, Sean Varga. Sean shares the unique challenges and best practices in AppSec sales, like the importance of empathy, understanding customer needs, and community participation. Learn about the OWASP top 10 for AppSec Sales and discover how to achieve success by aligning with customer goals, maintaining detailed living documents, and fostering strong partnerships.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Sarah-Jane Madden -- What AI means for AppSec

Sarah Jane Madden joins us to discuss the evolving role of AI in software development. We reflect on the changes and challenges posed by AI, including the potential for over-reliance and the misconception that traditional software engineering practices like the SDLC are obsolete. The conversation explores the nuances of AI-generated code, emphasizing the importance of maintaining foundational engineering skills and a critical understanding of the tools used. Madden shares insights from her keynote at OWASP Barcelona and stresses the need for responsible and thoughtful integration of AI in development workflows. Key takeaways include leveraging AI for efficiency while avoiding complacency...

Dag Flachet -- Kaizen for your Appsec Program

Dag Flachet joins us to discuss the concept of Kaizen and its application in improving application security. Dag shares his journey into the world of security, emphasizing the importance of iterative, small-step improvements. The conversation delves into how organizations can effectively implement maturity models to enhance their security programs, the limitations of compliance-focused frameworks like ISO 27,000 and SOC 2, and the practical application of Kaizen principles. They also explore the evolution and future updates of OWASP SAM, and the importance of empowering development teams through a bottom-up approach in security enhancement. Dag is the co-founder of Codific, a professor...

Javan Rasokat and Andra Lezza -- When Chatbots Go Rogue - Lessons Learned from Building and Defending LLM Applications

Andra Lezza and Javan Rasokat discuss the complexities of securing AI and LLM applications. With years of experience in Application Security (AppSec), Andra and Javan share their journey and lessons from their DEF CON talk on building and defending LLMs. They explore critical vulnerabilities, prompt injection, hallucinations, and the importance of data security. This discussion sheds light on the evolving landscape of AI and LLM security, offering practical advice for developers and security professionals alike.Javans blog article: Adversarial Misuse of Generative AIJavans recommendation for the TLDR newsletterAndra's book recommendation: The Cuckoos Egg by Cliff StollFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The...

Jim Routh -- The CISO Transition to the rest of life

Former CISO Jim Routh discusses his perspective on retirement and career fulfillment in cybersecurity. Rather than viewing retirement as simply stopping work, Routh describes his three-filter approach: working only with people he respects and admires, doing only work he finds fulfilling, and controlling when he works. He shares valuable lessons learned about which post-retirement opportunities truly bring satisfaction and explains why he avoids certain roles. Routh emphasizes the importance of cybersecurity professionals taking ownership of their career development, recommending they focus on developing two specific skills annually rather than using tenure to guide career moves.The article written by Jim, published...

Henrik Plate -- OWASP Top 10 Open Source Risks

Henrik Plate joins us to discuss the OWASP Top 10 Open Source Risks, a guide highlighting critical security and operational challenges in using open source dependencies. The list includes risks like known vulnerabilities, compromised legitimate packages, name confusion attacks, and unmaintained software, providing developers and organizations a framework to assess and mitigate potential threats. Henrik offers insights on how developers and AppSec professionals can implement the guidelines. Our discussion also includes the need for a dedicated open-source risk list, and the importance of addressing known vulnerabilities, unmaintained projects, immature software, and more.The OWASP Top 10 Open Source RisksFOLLOW OUR SOCIAL...

Tanya Janca -- A Secure SDLC from a Developer's Perspective

Security expert Tanya Janca discusses her new book "Alice and Bob Learn Secure Coding" and shares insights on making security accessible to developers. In this engaging conversation, she explores how security professionals can better connect with developers through threat modeling, maintaining empathy, and creating inclusive learning environments. Tanya emphasizes the importance of system maintenance after deployment and shares practical advice on input validation, while highlighting how security teams can build better relationships with development teams by avoiding arrogance and embracing collaboration.Tanyas new book: Alice & Bob Learn Secure CodingThree Individuals that Tanya would like to introduce to you:Confidence Staveley https://confidencestaveley.com/Rana...

Mehran Koushkebaghi -- Security as a Systemic Concern: How to develop Anti-Requirements

Mehran Koushkebaghi, a seasoned engineering expert, delves into the intricacies of systemic security. He draws parallels between civil engineering and IT systems, and explains the importance of holistic thinking in security design. Discover the difference between semantic and syntactic vulnerabilities and understand how anti-requirements play a critical role in system resilience. This episode offers fresh perspectives on application security.Books recommended by Mehran:Critical System Thinking Book by Mike JacksonThe Fifth Discipline by Peter SengeUnderstanding Complexity on Audible read by Scott E PageNassim Taleb booksFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Kalyani Pawar -- Shaping AppSec at Startups

Kalyani Pawar shares critical strategies for integrating security early and effectively in AppSec for startups. She recommends that startups begin focusing on AppSec around the 30-employee mark, with an ideal ratio of one AppSec professional per 10 engineers as the company grows. Pawar emphasizes the importance of building a security culture through "culture as code" - implementing automated guardrails and checkpoints that make security an integral part of the development process. She advises startups to prioritize visibility into their systems, conduct pentests, develop thoughtful policies, and carefully vet third-party tools and open-source solutions. Ultimately, Pawar's approach is about making security...

Milan Williams -- AppSec Metrics

Milan Williams discusses the importance of application security metrics and how to make them both meaningful and actionable. She explains that metrics are crucial for tracking progress in what can often feel like an overwhelming security landscape, and they're valuable for career advancement and securing resources. We discuss metrics categories and several specific metrics that are good to track. Milan shares important principles on the importance of making metrics actionable through storytelling and relating security impacts to real-world consequences for users.Milan's Book Recommendation:Quiet Influence: The Introverts Guide to Making a Difference by Jennifer KahnweilerFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application...

MO Sadek -- Building an AppSec Program from Scratch

Mo Sadek shares his unique journey of building an Application Security program from scratch at Roblox. Mo discusses his unconventional path, including temporarily joining the infrastructure team to truly understand engineering challenges. He emphasizes that security isn't about mandating rules, but about making processes easier and more secure by default. Mo shares his insights on how to build effective cross-team security relationships and approaches for gaining leadership buy-in.Mo's Book Recommendation: I Have No Mouth and I Must Scream by Harlan EllisonFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Brett Crawley -- Threat Modeling Gameplay with EoP

Brett Crawley discusses the Elevation of Privilege (EoP) card game, a powerful tool for threat modeling in software development. The discussion explores recent extensions to the game including privacy-focused suits and TRIM (Transfer, Retention/Removal, Inference, Minimization) categories. Crawley emphasizes that threat modeling shouldn't end with the game but should be an ongoing process throughout an application's lifecycle, ideally starting before implementation. He also shares insights from his book, which provides detailed examples and guidance for teams new to threat modeling using EoP.You can find Brett on X @brettcrawleyBretts book: Threat Modeling Gameplay with EoP: A reference manual for spotting threats...

Matin Mavaddat - Understanding Security as a Systemic Concern: The Role of Anti-Requirements

Matin Mavaddat discusses his perspective on security as a systemic concern, developed from his background in requirements engineering and systems architecture. He introduces the concept of "anti-requirements" - defining what a system should not do - and distinguishes between "syntactic security" (addressing technical vulnerabilities that are always incorrect) and "semantic security" (context-dependent security emerging from system interactions). Mavaddat shares his perspective that security itself doesn't have independent existence but rather emerges from preventing undesirable states. The discussion concludes with practical implementation strategies, suggesting that while automated tools can handle syntactic security issues, organizations should focus more energy on semantic security...

Kayra Otaner -- DevSecOps

Kayra Otaner joins the podcast today to discuss DevSecOps and answer the question, is it dead? Kayra is the Director of DevSecOps at Roche and is highly involved in the DevSecOps community. Kayra states that DevSecOps in its traditional form is dead and that each organization should approach its needs based on their size. Otaner introduces the concept of "security as code" and "policy as code" as more effective approaches, where security functions are codified rather than relying on traditional documentation and checklists. Finally, they discuss the emergence of Application Security Posture Management (ASPM) tools as the "SIM for AppSec,"...

Franois Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages

Franois Proulx shares his discovery of security vulnerabilities in build pipelines. Francois has found that attackers can exploit this often overlooked side of the software supply chain. To help address this, his team developed an open source scanner called Poutine that can identify vulnerable build pipelines at scale and provide remediation guidance. Francois has over 10 years of experience in building application security programs, hes also the founder of the NorthSec conference in Montreal.Mentioned in the Episode:Cooking for Geeks by Jeff PotterPoutine Living Off the Pipeline projectGrand Theft Actions Abusing Self Hosted GitHub Runners - Adnan Khan and John StawinskiWhere...

Steve Wilson -- The Developer's Playbook for Large Language Model Security: Building Secure AI Applications

Steve Wilson, the author of 'The Developer's Playbook for Large Language Model Security is back to dive into topics from his book like AI hallucinations, trust, and the future of AI. Steve has been at the forefront of the explosion of activity at the intersection of AppSec, LLM, and AI. We discuss the biggest fears surrounding LLMs and AI, and explore advanced concepts like Retrieval Augmented Generation and prompt injection.Links:The Developers Playbook for Large Language Model Security by Steve WilsonFind Steve on LinkedInPrevious Episodes:Steve Wilson -- OWASP Top Ten for LLMsSteve Wilson and Gavin Klondike -- OWASP Top Ten for...

Jeff Williams -- Application Detection & Response (ADR)

Jeff Williams, a renowned pioneer in the field of application security is with us to discuss Application Detection and Response (ADR), detailing its potential to revolutionize security in production environments. Jeff shares stories from his career, including the founding of OWASP, and his take on security assurance. We cover many topics including; security assurance, life, basketball and plenty of AppSec as well.Where to find Jeff:LinkedIn: https://www.linkedin.com/in/planetlevel/Previous Episodes:Jeff Williams The Tech of Runtime SecurityJeff Williams The History of OWASPFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Phillip Wylie -- Pen Testing from Somebody who Knows about Pen Testing

Philip Wiley shares his unique journey from professional wrestling to being a renowned pen tester. We define pen testing and the role of social engineering in ethical hacking. We talk tools of the trade, share a favorite web app pentest hack and offer good advice on starting a career in cybersecurity. Philip shares some insights from his book, The Pentester Blueprint: Starting a Career as an Ethical Hacker. And we discuss the impact of AI on pen testing and where this field is headed in the next few years.The Pentester Blueprint Starting a Career as an Ethical Hacker written by...

Steve Springett -- Software and System Transparency

Steve Springett, an expert in secure software development and a key figure in several OWASP projects is back. Steve unpacks CycloneDX and the value proposition of various BOMs. He gives us a rundown of the BOM landscape and unveils some new BOM projects that will continue to unify the security industry. Steve is a seasoned guest of the show so we learn a bit more about Steve's hobbies, providing a personal glimpse into his life outside of technology.Links from this episode:https://cyclonedx.org/Previous episodes with Steve Springett:JC Herz and Steve Springett -- SBOMs and software supply chain assuranceSteve Springett An insiders checklist...

Irfaan Santoe -- The Power of Strategy in AppSec

Irfaan Santoe joins us for an in-depth discussion on the power of strategy in Application Security. We delve into measuring AppSec maturity, return on investment, and communicating technical needs to business leaders. Irfaan shares his unique journey from consulting to becoming an AppSec professional, and addresses the gaps between CISOs and AppSec knowledge. Irfaan shares valuable insights for scaling AppSec programs and aligning them with business objectives.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Andrew Van Der Stock -- The New OWASP Top Ten

Andrew Van Der Stok, a leading web application security specialist and executive director at OWASP joins us for this episode. We discuss the latest with the OWASP Top 10 Project, the importance of data collection, and the need for developer engagement. Andrew gives us the methodology behind building the OWASP Top 10, the significance of framework security, and much more.Previous episodes with Andrew Van Der StockAndrew van der Stock Taking Application Security to the MassesAndrew van der Stock and Brian Glas -- The Future of the OWASP Top 10Books mentioned in the episode:The Crown Road by Iain BanksEdward Tufte FOLLOW...

Derek Fisher -- Hiring in Cyber/AppSec

Derek Fisher, an expert in hardware, software, and cybersecurity with over 25 years of experience is back on the podcast. Derek shares his advice on cybersecurity hiring, specifically in application security, and dives into the challenges of entry-level roles in the industry. We discuss the value of certifications, the necessity of lifelong learning, and the importance of networking. Listen along for good advice on getting noticed in cybersecurity, resume tips, and the evolving landscape of AppSec careers.Mentioned in this episode:The Application Security Handbook by Derek FisherWith the Old Breed by E.B. SledgeCyber for Builders by Ross HaleliukEffective Vulnerability Management by...

Tanya Janca -- Secure Guardrails

Tanya Janka, also known as SheHacksPurple, discusses secure guardrails, the difference between guardrails and paved roads, and how to implement both in application security. Tanya is an award-winning public speaker and head of education at SEMGREP and the best-selling author of Alice and Bob Learn Application Security. Tanya shares her insights on creating secure software and teaching developers in this episode.Mentioned in this episode:Tanya Janca What Secure Coding Really MeansTanya Janca Mentoring Monday - 5 Minute AppSecTanya Janca and Nicole Becher Hacking APIs and Web Services with DevSlopThe Expanse Series by James S.A. CoreyAlice and Bob Learn Application Security by...

Jahanzeb Farooq -- Launching and executing an AppSec program

Jahanzeb Farooq discusses his journey in cybersecurity and the challenges of building AppSec programs from scratch. Jahanzeb shares his experience working in various industries, including Siemens, Novo Nordisk, and Danske Bank, highlighting the importance of understanding developer needs and implementing the right tools. The conversation covers the complexities of cybersecurity in the pharmaceutical and financial sectors, shedding light on regulatory requirements and the role of software in critical industries. Learn about prioritizing security education, threat modeling, and navigating digital transformation.Mentioned in this Episode:The Power of Habit by Charles DuhiggFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

David Quisenberry -- Building Security, People, and Programs

David Quisenberry shares about his journey into the security world, insights on building AppSec programs in small to mid-sized companies, and the importance of data-driven decision-making. The conversation delves into the value of mentoring and why it's important to build real relationships with the people you work with, the vital role of trust with engineering teams, and the significance of mental health and community in the industry.Books Shared in the Episode:SRE Engineering by Betsy Beyer, Chris Jones, Jennifer Petoff and Niall Richard Murphy The Phoenix Project by Gene Kim, Kevin Behr and George SpaffordSecurity Chaos Engineering by Aaron Rinehart and...

Matt Rose -- Software Supply Chain Security Means Many Different Things to Different People

Matt Rose, an experienced technical AppSec testing leader discusses his career journey and significant contributions in AppSec. The conversation delves into the nuances of software supply chain security and exploring how different perceptions affect its understanding. Matt provides insights into the XZ compromise, critiques the buzzword 'shift left,' and discusses the role of digital twins and AI in enhancing the supply chain security. He emphasizes the need for a comprehensive approach beyond SCA, the relevance of threat modeling, and the potential risks and benefits of AI in security.Mentioned in the episode:The Application Security Program Handbook by Derek Fisher https://www.manning.com/books/application-security-program-handbookPodcast Episode:...

James Berthoty -- Is DAST Dead? And the future of API security

James Berthoty, a cloud security engineer with a diverse IT background, discusses his journey into application and product security. James highlights his career trajectory from IT operations to cloud security, his experiences with security tools like Snyk and StackHawk, and the evolving landscape of Dynamic Application Security Testing (DAST) and API security. They delve into the practical challenges of CVEs, reachability analysis, and the complexities of patching in mid-sized companies. James shares his views on the often misunderstood role of WAF and the importance of fixing issues over merely identifying them. James Berthotys LinkedIn post: AppSec Kool-Aid Statements I Disagree...

Mark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding

Mark Curphey and Simon Bennetts, join Chris on the podcast to discuss the challenges of funding and sustaining major open source security projects like ZAP.Curphey shares about going fully independent and building a non-profit sustainable model for ZAP. The key is getting companies in the industry, especially companies commercializing ZAP, to properly fund its ongoing development and maintenance.Bennetts, who has led ZAP for over 15 years, shares the harsh reality that while ZAP is likely the world's most popular web scanner with millions of active users per month, very few companies contribute back financially despite making millions by building products...

Devin Rudnicki -- Expanding AppSec

Devon Rudnicki, the Chief Information Security Officer at Fitch Group, shares her journey of developing an application security program from scratch and advancing to the CISO role. She emphasizes the importance of collaboration, understanding the organization's business, and using metrics to drive positive change in the security program.Elon Musk - Walter IsaacsonSteve Jobs - Walter IsaacsonThe Code Breaker: Jennifer Doudna, Gene Editing, and the Future of the Human Race - Walter Isaacsonhttps://www.simonandschuster.com/authors/Walter-Isaacson/697650FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Dustin Lehr -- Culture Change through Champions and Gamification

Dustin Lehr, Senior Director of Platform Security/Deputy CISO at Fivetran and Chief Solutions Officer at Katilyst Security, joins Robert and Chris to discuss security champions. Dustin explains the concept of security champions within the developer community, exploring the unique qualities and motivations behind developers becoming security advocates. He emphasizes the importance of fostering a security culture and leveraging gamification to engage developers effectively. They also cover the challenges of implementing security practices within the development process and how to justify the need for a champion program to engineering leadership. Dustin shares insights from his career transition from a developer to...

Francesco Cipollone -- Application Security Posture Management and the Power of Working with the Business

Francesco Cipollone, CEO of Phoenix Security, joins Chris and Robert to discuss security and explain Application Security Posture Management (ASPM). Francesco shares his journey from developer to cybersecurity leader, revealing the origins and importance of ASPM. The discussion covers the distinction between application security and product security, the evolution of ASPM from SIEM solutions, and ASPM's role in managing asset vulnerabilities and software security holistically. Francesco emphasizes the necessity of involving the business side in security decisions and explains how ASPM enables actionable, risk-based decision-making. The episode also touches on the impact of AI on ASPM. It concludes with Francesco...

Mukund Sarma -- Developer Tools that Solve Security Problems

Mukund Sarma, the Senior Director for Product Security at Chime, talks with Chris about his career path from being a software engineer to becoming a leader in application security. He explains how he focuses on building security tools that are easy for developers to use and stresses the importance of looking at application security as a part of the broader category of product security. Mukund highlights the role of collaboration over security mandates and the introduction of security scorecards for proactive risk management. He and Chris also discuss the strategic implementation of embedded security functions within development teams. Discover the...

Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec

AppSec specialist Megan Jacquot joins Chris and Robert for a compelling conversation about community, career paths, and productive red team exercises. Megan shares her unique cybersecurity origin story, tracing her interest in the field from childhood influences through her tenure as an educator and her formal return to academia to pivot into a tech-focused career. She delves into her roles in threat intelligence and application security, emphasizing her passion for technical work, penetration testing, and bug bounty programs. Additionally, Megan highlights the importance of mentorship, her involvement with the Women in Cybersecurity (WeCyS) community, and her dedication to fostering the...

Bill Sempf -- Development, Security, and Teaching the Next Generation

Robert is joined by Bill Sempf, an application security architect with over 20 years of experience in software development and security. Bill shares his security origins as a curious child immersed in technology, leading to his lifelong dedication to application security. They discuss CodeMash, a developer conference in Ohio, and recount Bill's presentation on the Veilid application framework, designed for privacy-driven mobile applications. Bill also explores his efforts in educating children about technology and programming, drawing on his experiences with Kidsmash and other initiatives. Additionally, they delve into the challenges of application security, particularly modern software development practices and the...

Hendrik Ewerlin-- Threat Modeling of Threat Modeling

Robert and Chris talk with Hendrik Ewerlin, a threat modeling advocate and trainer. Hendrik believes you can threat model anything, and he recently applied threat modeling to the process of threat modeling itself. His conclusions are published in the document Threat Modeling of Threat Modeling, where he aims to help practitioners, in his own words, "tame the threats to the threat modeling process." They explore the role of threat modeling in software development, emphasizing the dire consequences of overlooking this crucial process. They discuss why threat modeling serves as a cornerstone for security, and why Hendrik stresses the importance of...

Jason Nelson -- Three Pillars of Threat Modeling Success: Consistency, Repeatability, and Efficacy

Jason Nelson, an accomplished expert in information security management, joins Chris to share insights on establishing successful threat modeling programs in data-intensive industries like finance and healthcare. Jason presents his three main pillars to consider when establishing a threat modeling program: consistency, repeatability, and efficacy. The discussion also provides a series of fascinating insights into security practices, regulatory environments, and the value of a threat modeling champion. As a threat modeling practitioner, Jason provides an essential perspective to anyone serious about application security.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Erik Cabetas -- Cracking Codes on Screen and in Contests: An Expert's View on Hacking, Vulnerabilities, and the Evolution of Cybersecurity Language

Erik Cabetas joins Robert and Chris for a thought-provoking discussion about modern software security. They talk about the current state of vulnerabilities, the role of memory-safe languages in AppSec, and why IncludeSec takes a highly systematic approach to security assessments and bans OWASP language. Along the way, Erik shares his entry into cybersecurity and his experience consulting about hacking for TV shows and movies. The conversation doesn't end before they peek into threat modeling, software engineering architecture, and the nuances of running security programs.Helpful Links:Security Engineering by Ross Anderson - https://www.wiley.com/en-us/Security+Engineering%3A+A+Guide+to+Building+Dependable+Distributed+Systems%2C+3rd+Edition-p-9781119642817New School of Information Security by Adam Shostack and Andrew...

Justin Collins-- Enabling the Business to Move Faster, Securely

Justin Collins of Gusto joins Robert and Chris for a practical conversation about running security teams in an engineering-minded organization. Justin shares his experience leading product security teams, the importance of aligning security with business goals, and the challenges arising from the intersection of product security and emerging technologies like GenAI.They also discuss the concept of security partners and the future of AI applications in the field of cybersecurity. And he doesnt finish before sharing insights into the role of GRC and privacy in the current security landscape. Find out why Justin believes that above all, security should align with...

Kyle Kelly -- The Dumpster Fire of Software Supply Chain Security

Kyle Kelly joins Chris to explore the wild west of software supply chain security. Kyle, author of the CramHacks newsletter, sheds light on the complicated and often misunderstood world of software supply chain security. He brings unique insights into the challenges, issues, and potential solutions in this constantly growing field. From his experiences in sectors like cybersecurity and security research, he adapts a critical perspective on the state of the software supply chain, suggesting it is in a 'dumpster fire' state. We'll dissect that incendiary claim and discuss the influence of open-source policies, the role of GRC, and the importance...

Chris Hughes -- Software Transparency

Chris Hughes, co-founder of Aquia, joins Chris and Robert on the Application Security Podcast to discuss points from his recent book Software Transparency: Supply Chain Security in an Era of a Software-Driven Society, co-authored with Tony Turner. The conversation touches on the U.S. government in the software supply chain, the definition and benefits of software transparency, the concept of a software bill of materials (SBOM), and the growth of open-source software. The episode also covers crucial topics like compliance versus real security in software startups, the role of SOC 2 in setting security baselines, and the importance of threat modeling...

Jay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future.

Jay Bobo and Darylynn Ross from CoverMyMeds join Chris to explain their assertion that 'AppSec is Dead.' They discuss the differences between product and application security, emphasizing the importance of proper security practices and effective communication with senior leaders, engineers, and other stakeholders. Jay proposes that product security requires a holistic approach and cautions against the current state of penetration testing in web applications. Darylynn encourages AppSec engineers to broaden their scope beyond individual applications to product security. With enlightening insights and practical advice, this episode thoughtfully challenges AppSec professionals with new ideas about application and product security.Links:Jay recommends:How to...

Eitan Worcel -- Is AI a Security Champion?

Eitan Worcel joins the Application Security Podcast, to talk automated code fixes and the role of artificial intelligence in application security. We start with a thought-provoking discussion about the consistency and reliability of AI-generated responses in fixing vulnerabilities like Cross-Site Scripting (XSS). The conversation highlights a future where AI on one side writes code while AI on the other side fixes it, raising questions about the outcomes of such a scenario.The discussion shifts to the human role in using AI for automated code fixes. Human oversight is important in setting policies or rules to guide AI, as opposed to letting...

Bjrn Kimminich -- OWASP Juice Shop

Bjorn Kimminich, the driving force behind the OWASP Juice Shop project, joins Chris and Robert to discuss all things Juice Shop. The OWASP Juice Shop is a deliberately vulnerable web application that serves as an invaluable training tool for security professionals and enthusiasts. Bjorn provides a comprehensive overview of the latest features and challenges introduced in the Juice Shop, underscoring the project's commitment to simulating real-world security scenarios.Key highlights include the introduction of coding challenges, where users must identify and fix code vulnerabilities. This interactive approach enhances the learning experience and bridges the gap between theoretical knowledge and practical application....

Arshan Dabirsiaghi -- Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io

Arshan Dabirsiaghi of Pixee joins Robert and Chris to discuss startups, AI in appsec, and Pixee's Codemodder.io. The conversation begins with a focus on the unrealistic expectations placed on developers regarding security. Arshan points out that even with training, developers may not remember or apply security measures effectively, especially in complex areas like deserialization. This leads to a lengthy and convoluted process for fixing security issues, a problem that Arshan and his team have been working to address through their open-source tool, Codemodder.io.Chris and Arshan discuss the dynamic nature of the startup world. Chris reflects on the highs and lows...

Dr. Jared Demott -- Cloud Security & Bug Bounty

Chris and Robert are thrilled to have an insightful conversation with Dr. Jared Demott, a seasoned expert in the field of cybersecurity. The discussion traverses a range of topics, from controversial opinions on application security to the practical aspects of managing bug bounty programs in large corporations like Microsoft.We dive into the technicalities of bug bounty programs, exploring how companies like Microsoft handle the influx of reports and the importance of such programs in a comprehensive security strategy. Dr. Demott provides valuable insights into the evolution of bug classes and the never-ending challenge of addressing significant bug types, emphasizing that...

Katharina Koerner -- Security as Responsible AI

Dr. Katharina Koerner, a renowned advisor and community builder with expertise in privacy by design and responsible AI, joins Chris and Robert to delve into the intricacies of responsible AI in this episode of the Application Security Podcast. She explores how security intersects with AI, discusses the ethical implications of AI's integration into daily life, and emphasizes the importance of educating ourselves about AI risk management frameworks. She also highlights the crucial role of AI security engineers, the ethical debates around using AI in education, and the significance of international AI governance. This discussion is a deep dive into AI,...

Ray Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring

For Security Pros & Business Leaders | Strategic Insights & Leadership Lessons When Ray Espinoza joined Chris and Robert on the Application Security Podcast, he gave a treasure trove of insights for both security professionals and business leaders alike! Whether you're deep in the trenches of information security or steering the ship in business leadership, this episode is packed with valuable takeaways. Dive in to discover why this is a must-listen for professionals across the spectrum. For Security Professionals:1. CISO Insights: Gain a glimpse into the strategic mind of a Chief Information Security Officer. Learn from their real-world experiences and...

Chris John Riley -- MVSP: Minimum Viable Secure Product

Chris John Riley joins Chris and Robert to discuss the Minimum Viable Secure Product. MVSP is a minimalistic security checklist for B2B software and business process outsourcing suppliers. It was designed by a team that included experts from Google, Salesforce, Okta, and Slack. The MVSP objectives are targeted at startups and other companies creating new applications, helping such organizations meet security standards expected by larger enterprises like Google. The MVSP is designed to be accessible for users, as a way to streamline the process of vendor assessment and procurement from the start to the contractual control stages.Using MVSP, developers and...

Steve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Release

Steve Wilson and Gavin Klondike are part of the core team for the OWASP Top 10 for Large Language Model Applications project. They join Robert and Chris to discuss the implementation and potential challenges of AI, and present the OWASP Top Ten for LLM version 1.0. Steve and Gavin provide insights into the issues of prompt injection, insecure output handling, training data poisoning, and others. Specifically, they emphasize the significance of understanding the risk of allowing excessive agency to LLMs and the role of secure plugin designs in mitigating vulnerabilities.The conversation dives deep into the importance of secure supply chains...

Tanya Janca -- What Secure Coding Really Means

Tanya Janca, also known as SheHacksPurple, joins the Application Security Podcast again to discuss secure coding, threat modeling, education, and other topics in the AppSec world. With a rich background spanning over 25 years in IT, coding, and championing cybersecurity, Tanya delves into the essence of secure coding.Tanya highlights the difference between teaching developers about vulnerabilities and teaching them the practices to avoid these vulnerabilities in the first place. Instead of focusing on issues like SQL injection, she emphasizes the importance of proactive measures like input validation and always using parameterized queries. She believes teaching developers how to build secure...

Hasan Yasar -- Actionable SBOM via DevSecOps

Hasan Yasar believes that everyone shares the responsibility of creating a secure environment, and this can only be achieved by working collaboratively. He underscores the idea that security is not an isolated endeavor but a collective effort, urging everyone to come together and build a world where safety and security are paramount.Yasar also shares his thoughts about education and security. He highlights the need for integrating security concepts right from the foundational levels of teaching programming languages. By introducing concepts like input validation and sanitization early on, students can be better equipped to handle security challenges in their professional lives....

Varun Badhwar -- The Developer Productivity Tax

Varun Badhwar is a three-time founder, a luminary in the cyber security industry, and a clear communicator. He joins Chris and Robert on the Application Security Podcast to discuss scanning with context, SBOM plus VEX, and the developer productivity tax. The concept of a "Developer Productivity Tax" acknowledges the challenges developers face when bombarded with a plethora of vulnerabilities. This "tax" represents the drain on developers' time and resources as they navigate through a myriad of potential threats, many of which lack actionable context. The inefficiencies arising from this process can lead to significant delays in software development, emphasizing the...

OWASP Board of Directors Debate

The Application Security Podcast presents the OWASP Board of Directors Debate for the 2023 elections. This is a unique and engaging discussion among six candidates vying for a position on the board. Throughout the debate, candidates address pressing questions about their priorities as potential board members, the future direction of OWASP, and strategies for community growth and vendor neutrality. Topics such as vendor agnosticism, the allocation of profits from global OWASP events, and the importance of community involvement are among the critical issues discussed.The questions presented by Chris and Robert include:What experience do you have running an organization like OWASP?...

Itzik Alvas -- Secrets Security and Management

Itzik Alvas, Co-founder and CEO of Entro, is an expert on secrets security.Itzik joins Chris and Robert to discuss the significance of understanding and managing secrets, emphasizing the importance of knowing how many secrets an organization has, where they are located, and their potential impact. He elaborates on the three pillars of secrets management: listing and locating secrets, classifying and understanding their potential blast radius, and monitoring them for any abnormal behavior.The conversation takes a turn towards the future of secrets management, where Itzik believes there's a need for a shift in mentality. He stresses the importance of education in...

Harshil Parikh -- Deep Environmental and Organizational Context in Application Security

Harshil Parikh is a seasoned security leader with experience building security and compliance functions from the ground up. He notably built the security and compliance team at Medallia from scratch and led it through several transitions. He is also a conference speaker, and, most recently, he co-founded Tromzo. Harshil shares insights about AppSec, running a startup, selling effectively, and provides justification for his mantra, "Context is king." Harshil underscores the importance of understanding context in security, emphasizing that it's the bedrock for making informed decisions. He also brings to light the significance of data-driven metrics in application security.Harshil champions the...

Jeff Williams -- The Tech of Runtime Security

Jeff Willams of Contrast Security joins Chris and Robert on the Application Security Podcast to discuss runtime security, emphasizing the significance of Interactive Application Security Testing (IAST) in the modern DevOps landscape. After reflecting on the history of OWASP, the conversation turns to the challenges organizations face in managing their application security (AppSec) backlogs. Jeff highlights the alarming number of unresolved issues that often pile up, emphasizing the inefficiencies of traditional security tools.Jeff champions IAST, and here are a few highlights that he shares. IAST is ideally suited for DevOps by seamlessly transforming regular test cases into security tests. IAST...

Mark Curphey and John Viega -- Chalk

Mark Curphey and John Viega join Chris and Robert to explain the details of Chalk, Crash Override's new tool. Mark also talks about why ZAP departed from OWASP and joined the Software Security Project, highlighting some of the value and differences of both organizations. Open Source Software is important to the industry, but Mark calls on companies to contribute to the development and support of the projects they use. The conversation explores the challenges faced by companies, especially large tech firms, in managing their software engineering processes. Many organizations grapple with identifying code ownership, determining code versions during incidents, and...

Maril Vernon -- You Get What You Inspect, Not What You Expect

Maril Vernon is passionate about Purple teaming and joins Robert and Chris to discuss the intricacies of purple teaming in cybersecurity. She underscores the significance of fostering a collaborative environment between developers and the security team. Drawing from her experiences, Maril shares the challenge of development overlooking her remediation recommendations. She chose to engage directly with the developers, understanding their perspective and subsequently learning to frame her remediations in developer-centric language. This approach made her recommendations actionable and bridged the communication gap between the two teams.Maril also looks into the future of purple teaming, envisioning a landscape dominated by automation...

Dan Kykendall -- Why All Application Security Products Suck

Dan Kykendall visits The Application Security Podcast to discuss his series "Why All AppSec Products Suck" and explain why software companies should understand the uses and limitations of any security tool. The series aims to highlight the limitations of each tool and to help users make informed decisions when selecting the right tools for their needs. In this field, there is no such thing as an expert; there is always something new to learn.Dan, Chris, and Robert remember the late Kevin Mitnick, a well-known figure in the cybersecurity community. They share their personal experiences with Mitnick, highlighting his curiosity, humility,...

Kevin Johnson -- Samurai Swords and Zap's Departure

Kevin Johnson is the CEO of Secure Ideas. He began his career as a developer but turned toward security when he discovered that the interface for an intrusion detection system, Snort, was out of date. This led him to create BASE (Basic Analysis and Security Engine), a testament to Kevin's proactive approach.Kevin has a deep-rooted passion for open-source projects. He highlights the challenges and joys of initiating and sustaining such ventures, emphasizing the pivotal role of community contributions. Kevin also details how to install and start with SamuraiWTF, a tool tailored for those keen on mastering application security. He outlines...

Tony Quadros -- The Life of an AppSec Vendor

Tony Quadros, the AppSec Lumberjack, shares the unique career path that led him to find his passion in Application Security. The discussion delves into the work of an AppSec vendor, with Tony explaining his role and the responsibilities it entails. He emphasizes the importance of understanding the needs and environment of the customer, and whether the product he represents can fulfill their requirements. Tony also shares his philosophy of sales, centered around solving problems and providing business value.Tony reveals the challenges salespeople face in the cybersecurity industry, particularly the pressure to meet quotas and the need for good company culture....

Steve Giguere -- Cloud AppSec

Cloud security is on an evolutionary path, with newer platforms embracing secure-by-default settings. This has led to a significant improvement in security but also adds complexity as developers need to understand these defaults when deploying to the cloud.Steve Giguere defines cloud application security, describes cloud-first development and cloud complexity, security by default, and the need to broaden AppSec by creating new security personas and being secure from idea to destination. Steve provides many nuggets of insight from his travels, including pointing us to Wing, a programming language for the cloud that includes code and IaC together.We discuss the consolidation of...

Paul McCarty -- The Burrito Analogy of the Software Supply Chain

"Visualizing the Software Supply Chain" is a project which aims to kick off a discussion about the scope and breadth of the software supply chain.Paul McCarty emphasizes the importance of understanding what's in the software supply chain to secure it effectively. He uses the burrito analogy, stating that you can't decide if you want to eat it if you don't know what's in it. We discuss the nuances around the Software Bill of Materials (SBOM) and the importance of understanding the differences between various SBOMs, especially for companies that deploy frequently.The conversation also covers third-party components, such as APIs, SaaS...

Farshad Abasi -- Three Models for Deploying AppSec Resources

Farshad Abasi shares three models for deploying resources within application security teams:The Dedicated AppSec Person Model involves assigning an AppSec person to work with each team. Farshad shares his experience of working with developers and the challenges faced in getting them to understand and implement threat modeling. He also discusses the transition from waterfall to Agile and how it affected threat modeling.The Federated Model: A security consultant attends weekly standups and sprint planning sessions in this model. They work with a checklist to quickly determine if any user stories could be security sensitive. This model reduces the allocation required to...

Kim Wuyts -- The Future of Privacy Threat Modeling

Kim Wuyts discusses her work in privacy threat modeling with LINDDUN, a framework inspired by Microsoft's STRIDE for security threat modeling. LINDDUN provides a structure to analyze privacy threats across multiple categories such as linking, detecting data disclosure, and unawareness. The framework has been updated over the years to incorporate new knowledge and developments in privacy, and it has become recognized as a go-to approach for privacy threat modeling.Kim believes that privacy and security can be combined and highlights the importance of protecting individuals' rights and data while securing systems and assets.Privacy by design, which focuses on reducing unnecessary data...

Francois Proulx -- Actionable Software Supply Chain Security

Software supply chain -- how deep does the problem go? Franois is here to help us realize how deep the rabbit hole of the supply chain is and enlighten us with strategies to get out of the hole.Franois emphasizes the importance of branch protection in source code repositories as the cornerstone of any supply chain, highlighting the need for peer review and static code analysis before merging. He also discusses the concept of tag protection, which prevents anyone with rewrite access to the repository from modifying a tag. This is particularly important in the context of build systems, where an...

Steve Wilson -- OWASP Top Ten for LLMs

How do we do security in the world of AI and LLMs? A great place to start is with an OWASP project tasked with creating a standardized guideline for building secure AI applications with large language models such as ChatGPT. Enter OWASP Top Ten for LLMs, and Steve Wilson, the project leader.You'll experience Large Language Models (LLMs) and their implications in AI. Steve explains how the introduction of ChatGPT marked a significant shift in the AI landscape. He elaborates on the concept of LLMs, their functioning, and the unique properties that emerge when used at a large scale.Traditional OWASP Top...

JB Aviat -- The State of Application Security

What is the state of application security? JB Aviat answered that question, by creating the state of application security report based on data from Datadog customers using the application security and APM products. It provides insights into threat detection, vulnerability detection, prioritization, and general trends on where the most significant risks lie.We discuss:the prioritization of vulnerabilities;the risks associated with non-production environments like staging or pre-production. They discuss how attackers often target these environments, potentially as practice grounds, before launching an attack on the production environment;future trends of application security, particularly with the rise of low-code or no-code development tooling.FOLLOW OUR...

Joshua Wells -- Application Security in the Age of Zero Trust

What is zero trust, and how does it impact the world of applications and application security? We dive deep into zero trust with Joshua Wells, a seasoned cybersecurity expert with over ten years of experience. Joshua explores the intricacies of zero trust, a cybersecurity model that dictates no user or machine is trusted by default and must be authenticated every time.Listen in as Joshua discusses his journey from aspiring to be an NFL player to becoming a leading voice in cybersecurity. He shares insights on how zero trust operates in different domains, including architectural security, endpoint detection, mobile device management,...

Jeevan Singh -- The Future of Application Security Engineers

Jeevan Singh, the director of product security at Twilio, discusses the future of application security engineers. Singh highlights the importance of embedding security into all aspects of software development and the need for a strong security culture within organizations. He also explains the skills required for a senior application security engineer, such as application security, software development, and teaching skills. Singh underscores the importance of empathy and influence, emphasizing that soft skills can significantly affect adequate application security. He also discusses the impact of AI, particularly OpenAI's GPT, in supporting the work of security engineers by providing valuable insights and...

Tony Turner -- Threat Modeling and SBOM

Have you ever considered using an SBOM to inform your threat modeling? Tony Turner has. Tony joins us to discuss SBOMs, threat modeling, and the importance of Cyber Informed Engineering.Tony delves into the SBOM (Software Bill of Materials) concept, highlighting their value proposition in identifying vulnerabilities, demonstrating compliance with software licenses, and informing M&A activities and incident response indicators related to cyberattacks. We also explore the integration of SBOMs into the system engineering process and security engineering.Tony further introduces the concept of Consequence-Driven Cyber Informed Engineering, which emphasizes understanding the potential consequences of cyberattacks on critical infrastructure rather than just...

Christian Frichot -- Threat Modeling with hcltm

Christian Frichot, an AppSec hacker, security leader, and developer of hcltm. He discusses the DevOps threat modeling tool he dreamed up and built. The tech was created to fit into developers' workflows and leverage tools they are familiar with. hcltm is designed to drive valuable change and be updated and maintained easily by software engineers. It is a developer-centric software product not heavily opinionated on diagramming, allowing users to employ their preferred methods for threat modeling. The solution is still evolving, and Frichot is open to user feedback and suggestions to improve it. He encourages people to try hcltm and...

Zohar Shachar -- Bug Bounty from Both Sides

Zohar Shachar joins us to discuss the bug bounty process from both sides. Zohar has spent time as a bug bounty hunter and shares wisdom on avoiding bug bounty-causing issues for your AppSec posture. We hope you enjoy this conversation with...Zohar Shachar.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Sarah-jane Madden -- Threat Modeling to established teams

Sarah-Jane Madden is the Chief Information Security Officer of Sensing Technology Group. - part of Fortive. She has over 20 years of software experience, from the most formal environments to lets fix it in production type teams. She has been a longtime advocate of deliberate application security as a partnership with product management and believes security does not have to be an overhead. Sarah-Jane joins us to discuss her talk at OWASP Dublin, "Far from green fields introducing Threat Modeling to established teams." She shares lessons learned from her 3-year journey and is transparent with the mistakes she made along...

Jet Anderson -- The AppSec Code Doctor

Jet Anderson's passion is teaching today's software developers to write secure code as part of modern DevOps pipelines, at speed and scale, without missing a beat. He's been a software engineer for over 25 years and believes fixing security bugs is better than finding them. Jet joins us to discuss software or security engineer first, how fixing security bugs is better than just finding them, and the Code Doctor security training program he built and deployed. We hope you enjoy this conversation with...Jet Anderson.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

James Mckee -- Developer Security

James Mckee is a developer (MCPDEA) and security advocate (CISSP) whose biggest responsibility is leading developer security practices. He sets the standards and procedures for the practice's operations and leads all client engagement efforts concerning security. He also takes the lead in ensuring that company staff (developers specifically) are properly trained and following best practices concerning application security. Currently, he is responsible for training and providing product guidance for developers worldwide. James joins us to discuss offensive application security for developers. We also get into the role of security professionals in reaching developers outside of the security echo chamber. We...

Derek Fisher -- The Application Security Handbook

Derek is the author of The Application Security Handbook. He is a university instructor at Temple University, where he teaches software development security to undergraduate and graduate students. He is a speaker on topics in the cybersecurity space and has led security teams, large and small, at organizations in the healthcare and financial industries. Derek joins us to unpack the goals of an application security program, what is cutting edge in application security programs today, the role of open source vs. commercial, and guidance such as "decentralized application security." "enablement instead of gates; application security as a service," and "stop...

Rob van der Veer -- OWASP AI Security & Privacy Guide

Rob van der Veer has a 30-year background in software engineering, building AI businesses, creating software, and assessing software. He is a senior director at the Software Improvement Group, where he established practices for AI, security, and privacy. Rob is involved in several standardization initiatives like OWASP SAMM, ENISA, CIP, and AI security & privacy guide. He leads the writing group for the new ISO standard on AI engineering: 5338. Rob co-leads the OWASP integration project, with openCRE.org as a key result, aiming to create alignment in the standards landscape. Rob joins us to introduce the OWASP AI Security and...

Robyn Lundin -- Planning & organizing a penetration test as an AppSec team

Robyn Lundin started working in tech after a coding boot camp as a developer for a small startup. She then discovered her passion for security, pivoted into pentesting for NCC Group, and now works as a Senior Product Security Engineer for Slack.Robyn joins us to discuss the role of penetration testing within the application security realm. Robyn provides actionable guidance you can apply directly to your application pen testing program. We hope you enjoy this conversation with....Robyn Lundin.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Michael Bargury -- Low Code / No Code Security and an OWASP Top Ten

Michael Bargury is the Co-Founder and CTO of Zenity, where he helps companies secure their low-code/no-code apps. In the past, he headed security product efforts at Azure, focused on IoT, APIs and IaC.Michael is passionate about all things related to cloud, SaaS and low-code security and spends his time finding ways they could go wrong. He also leads the OWASP low-code security project and writes about it on DarkReading. Michael is a regular speaker at OWASP, BSides and DEFCON conferences.Michael joins us to unpack Low Code / No Code and the new OWASP Top Ten that defines specific risks against...

Alex Olsen -- Security champions, empowering developers, and AppSec training

Alex leads the Cyber Security Consulting Group, part of Rakuten's Cyber Security Defense Department. The group's dedication is to providing global security services, including security architecture, DevSecOps tooling and integration services, delivery of technical training, and running Rakuten's Security Champion community. His focus is on empowering teams to improve security throughout the development lifecycle.Alex joins us to discuss security champions, a topic near and dear to our hearts. We get into democratizing appsec, the value of security governance and empowerment activities for security champions and the organization, how scope, cost and effort fit, and the ROI of training and security...

Mark Curphey -- The future of OWASP

Mark Curphey is one of the creators of OWASP from the very early days. Mark worked in the background over the few decades of OWASP but has recently taken more to the spotlight. After running, he was elected and joined the OWASP Board of Directors.This conversation starts with the historical story of Mark and his history with OWASP. Then we jump into the visions for OWASP in the future and the plans in place to reach those goals. We hope you enjoy this conversation with...Mark Curphey.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Tiago Mendo -- How to scan at scale with OWASP ZAP

Tiago Mendo is a co-founder and CTO of Probely. He has extensive experience in pentesting applications, training, and providing all-around security consultancy.Tiago started working with security in the early 2000s, beginning with a tenure of 12 years at Portugal Telecom. While there, he built the web security team and worked with 150+ developers. He holds a Master's in Information Technology/Information Security from Carnegie Mellon University and a CISSP certification.He is also a qualified member of AP2SI, a non-profit organization that promotes Information Security in Portugal, and Co-Leader of the Lisbon OWASP Chapter. He is a frequent speaker at security events,...

Wolfgang Goerlich -- Security beyond vulnerabilities

J. Wolfgang Goerlich is an Advisory CISO for Cisco Secure. He has been responsible for IT and IT security in the healthcare and financial services verticals. Wolfgang has led advisory and assessment practices for cybersecurity consulting firms.Wolf joins us to talk about some security things that will stretch your mind, like security beyond vulnerabilities, how apps intended functionality can be misused, data privacy, and nudges and behavior science.Wolf challenged my thinking in this episode and pointed out a new area of threat modeling I had never considered. We hope you enjoy this conversation with... J. Wolfgang Goerlich.FOLLOW OUR SOCIAL MEDIA:Twitter:...

Sam Stepanyan -- OWASP Nettacker Project

Sam Stepanyan is an OWASP London Chapter Leader and an Independent Application Security Consultant with over 20 years of IT experience and a background in software engineering and web application development.Sam has worked for various financial services institutions in the City of London, specializing in Application Security consulting, Secure Software Development Lifecycle (SDLC), developer training, source code reviews and vulnerability management. He is also a Subject Matter Expert in Web Application Firewalls (WAF) and SIEM systems. Sam holds a Masters degree in Software Engineering and a CISSP certification.Sam joins us to introduce us to OWASP Nettacker. He describes the tool's...

Nick Aleks and Dolev Farhi -- GraphQL Security

Dolev Farhi is a security engineer and author with extensive experience leading security engineering teams in complex environments and scales in the Fintech and cyber security industries. Currently, he is the Principal Security Engineer at Wealthsimple. He is one of the founders of DEFCON Toronto (DC416). He enjoys researching vulnerabilities in IoT devices, participating in and building CTF challenges and contributing exploits to Exploit-DB.Nick Aleks is a leader in Toronto's cybersecurity community and a distinguished and patented security engineer, speaker, and researcher. He is currently the Senior Director of Security at Wealthsimple, leads his security firm, ASEC.IO, and is a...

Guy Barhart-Magen -- Log4j and Incident Response

With nearly 25 years of experience in the cyber-security industry, Guy held various positions in both corporates and startups.In his role as the CTO for the cyber crisis management firm Profero, his focus is making incident response fast and scalable, harnessing the latest technologies and a cloud-native approach.Guy is the BSidesTLV chairman and CTF lead, a Public speaker in well-known global security events (SAS, t2, 44CON, BSidesLV, and several DefCon villages, to name a few), and the recipient of the Cisco black belt security ninja honor Ciscos highest cybersecurity advocate rank.Guy joins us to explore his front-row seat for the...

Brett Smith -- Security is a Necessary Evil

Brett Smith is a Software Architect/Engineer/Developer with 20+ years of experience. Specialties: Automation, Continuous Integration/Delivery/Testing/DeploymentExpertise: Linux, packaging, and tool design. Brett joins us to discuss why he hates security and shares his vast knowledge of building a secure and cutting-edge build pipeline. We hope you enjoy this conversation with...Brett Smith.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Chen Gour-Arie -- The AppSec Map

Chen Gour-Arie is the Chief Architect and Co-Founder of Enso Security. With over 15 years of hands-on experience in cybersecurity and software development, Chen demonstrably bolstered the software security of dozens of global enterprise organizations across multiple industry verticals. An enthusiastic builder, he has focused his career on building tools to optimize and accelerate security testing and all related workflows. Ken joins us to introduce the AppSec Map and provides a live demo of the catalog and what AppSec practitioners can use it for. We hope you enjoy this conversation with...Chen Gour-Arie.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube:...

Dominique Righetto -- OWASP Secure Headers

Dominique Righetto is an AppSec enthusiast and OWASP projects contributor. Dominique joins us to discuss the OWASP Secure Headers project. We discuss headers at a high level and then dive into all the goodies you'll find within the project, from awareness, guidance, and a test suite that can be integrated into your CI/CD pipeline to test your security headers. We hope you enjoy this conversation with...Dominique Righetto.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Hillel Solow -- How to do AppSec without a security team

Hillel Solow is Chairman of the Board at ProtectOnce, where he helps guide product and security strategy. Hillel is a serial entrepreneur in the cybersecurity space, but his favorite thing is still writing code at 2 am.Hillel joins us to discuss how to do appsec without a security team. We explore the building blocks of an appsec program, and what appsec looks like for companies of different sizes, from startup to midsize to enterprise. Then dive into Hillel's most important advice for companies who can't afford a security person. We hope you enjoy this conversation with Hillel Solow.FOLLOW OUR SOCIAL...

Chris Romeo -- The Security Journey Story

In this episode of the Application Security Podcast, Chris Romeo walks through the origin story of Security Journey and shares some experiences taking a security startup from bootstrap to acquisition. Chris talks about how and why he started the company, what defining factors made Security Journey successful and why they're being acquired now. He ends by giving an overview of what to expect from Security Journey moving forward. We hope you enjoy this conversation withChris Romeo.Check out these resources for more information about the acquisition!Press Release: https://www.accesswire.com/702562/HackEDU-Acquires-Security-Journey-to-Provide-the-Most-Comprehensive-Application-Security-Training-Offering-Helping-Development-Teams-Deliver-Secure-Code-and-Protect-DataChris's Blog Post: https://www.securityjourney.com/post/hackedu-acquires-security-journeyJoe's Blog Post: https://www.hackedu.com/blog/hackedu-acquires-security-journey-to-create-industry-leading-application-security-offeringFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security...

Kristen Tan and Vaibhav Garg -- Machine Assisted Threat Modeling

In this episode of the Application Security Podcast, we talk to Kristen Tan and Vaibhav Garg from Comcast. They wrote a paper called "An Analysis of Open-source Automated Threat Modeling Tools and Their Extensibility from Security into Privacy". They join us to share their story about what they were doing and why they did it. We hope you enjoy this conversation with...Kristen and VG.https://www.usenix.org/publications/loginonline/analysis-open-source-automated-threat-modeling-tools-and-theirFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Patrick Dwyer -- CycloneDX and SBOMs

Patrick is a Senior Product Security Engineer in the Application Security team at ServiceNow. He is also Co-Leader of the OWASP CycloneDX project. A lightweight Software Bill of Materials (SBOM) standard designed for use in application security contexts and supply chain component analysis.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Omer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks

Daniel Krivelevich is a cybersecurity expert and problem solver, with 15+ years of enterprise security experience with a proven track record working with 100+ enterprises across multiple industries, with a strong orientation to Application & Cloud Security. Daniel co-Founded Cider Security as the companys CTO. Cider is a startup focused on securing CI/CD pipelines, flows, and systems.Omer is a seasoned application and cloud security expert with over 13 years of experience across multiple security disciplines. An experienced researcher and public speaker, Omer discovered the Web Cache Deception attack vector in 2017. Omer leads research at Cider Security.We hope you enjoy...

Josh Grossman -- Building a High-Value AppSec Scanning Program

Josh Grossman has over 15 years of experience in IT Risk and Application Security consulting, and he has also worked as a software developer. He currently works as CTO for Bounce Security, where he focuses on helping organizations build secure products by providing value-driven Application Security support and guidance.In his spare time, he is very involved with OWASP. He is on the OWASP Israel chapter board, he is a co-leader of the OWASP Application Security Verification Standard project, and he has contributed to various other projects as well, including the Top 10 Risks, Top Ten Proactive Controls and JuiceShop projects.We...

Alex Mor -- Application Risk Profiling at Scale

Alex Mor is a passionate cybersecurity defender or breaker depending on the time of day, providing expert technical guidance to product teams and building security in their platforms. Alex joins us to talk about application risk profiling. He defines what this concept is to help us understand it. Then we talk about how can you do application risk profiling at scale? Whether you have ten applications or 1500 applications? How do you bring this together and gain real true security value from this idea of profiling your applications? We hope you enjoyed this conversation with Alex Mor.FOLLOW OUR SOCIAL MEDIA:Twitter:...

Brenna Leath -- Product Security Leads: A different way of approaching Security Champions

Brenna Leath is currently the Head of Product Security for a data analytics company where she sets the application security strategy for R&D and leads a team of security architects. Brenna originally joined us to talk about EO 14028 and the implications for private sector programs, BUT, we were chatting about security champions and product security leads, and we changed our focus to cover these topics instead. We hope you enjoy this conversation with...Brenna Leath.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Will Ratner -- Centralized container scanning

Will Ratner is a software security professional with extensive experience building and implementing security solutions across a myriad of industries including banking, media, construction, and information technology. In his current role at Atlassian, Will focuses on improving the vulnerability management process by building highly scalable and automated solutions for the enterprise. Will joins us to discuss a centralized approach he built for container scanning. We explore the challenges and lessons learned, building a scalable, enterprise-grade solution, and how to build something that developers will see value in. We hope you enjoy this conversation with...Will Ratner.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The...

Neil Matatall -- AppSec at Scale

Neil Matatall is an engineer with a background in security. He has previously worked at GitHub and Twitter and is a co-founder of Loco Moco Product Security Conference. Neil joins us for his second visit, to discuss account security at scale. He describes the underlying principles behind security at scale, how he worked to build a sign-in analysis feature, and how attacks were detected. We ended the conversation with an authentication lightning round, with Neil responding to various statements about authentication off the cuff! We hope you enjoy this episode with Neil Matatall.Check out our previous conversation with Neil Matatall.https://www.buzzsprout.com/1730684/8122595-neil-matatall-content-security-policyFOLLOW...

Joern Freydank -- Security Design Anti Patterns Limit Security Debt

Joern Freydank is a Lead Cyber Security Engineer with more than 20 years of experience. He is currently establishing the Threat Modeling Program at a major insurance company. Joern joins us to talk about security design anti-patterns. He defines the term, explains security debt, reviews the categories of anti-patterns, and walks us through the example of a common role misconception. We hope you enjoy this conversation with...Joern Freydank.For more from Joern, check out his talk, Security Design Anti-Patterns -- Creating Awareness to Limit Security Debt, from Global AppSec: https://youtu.be/o_Wq7Ga4M-0FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ken Toler -- Blockchain, Cloud, and #AppSec

Ken Toler is a principal consultant at Kudelski Security and is passionate about building and optimizing application security programs that stick through strong adoption and ease of use. Ken has spent considerable time on all sides of the security aisle from playing defense and managing security teams to offense by breaking applications and reviewing code. Ken is also the host and creator of the Relating to DevSecOps podcast that focuses on forging strong relationships between engineers, operations, and security through collaboration, understanding, skill-sharing, and healthy debate. Ken joins us to talk about all things Blockchain and AppSec. We define Blockchain,...

Jeroen Willemsen and Ben de Haan -- Dirty little secrets

Jeroen Willemsen is a passionate, hands-on security architect with a knack for mobile security and security automation. As a "jack of all trades," he has been involved with various OWASP projects and has developed various trainings. He has spent over 10 years as a full-stack developer and has worked as a (security) architect, security lead, and risk manager.Ben de Haan is a Freelance Security consultant and engineer. Ben's specialties are architecting and implementing cloud security and building secure CI/CD environments in Agile, DevOps, and SRE cultures. Ben believes security should be built-in and can be scaled to meet these modern...

Adam Shostack -- Fast, cheap and good threat models

Adam is a leading expert on threat modeling, and a consultant, expert witness, author and game designer. He has decades of experience delivering security. His experience ranges across the business world from founding startups to nearly a decade at Microsoft. While not consulting or training, Shostack serves as an advisor to a variety of companies and academic institutions. Adam joins us to talk about fast, cheap, and good threat models. We discuss how Adam defines these categories, the weight of threat modeling, questionnaires/requirements, expertise, and how to make threat modeling conversational. We hope you enjoy this conversation with...Adam Shostack.FOLLOW OUR...

Loren Kohnfelder -- Designing Secure Software

Loren Kohnfelder has over 20 years of experience in the security industry. At Microsoft, he was a key contributor to STRIDE, the industrys first formalized proactive security process methodology, and also program-managed the .NET platform security effort. At Google, he worked as a software engineer on the Security team and as a founding member of the Privacy team. Loren joins us to talk about his new book, Designing Secure Software. We start the conversation geeking out about his work to create STRIDE and digital certificates. We then discuss facets of the book, like secure software, security design review, and what...

Ochaun Marshall -- IaC and SAST

Ochaun Marshall is an Application Security Consultant. In his roles of secure ideas, he works on on-going development projects utilizing Amazon web services and breaks other people's web applications. Ochaun joins us to talk about SAST and IaC, static application security testing and infrastructure as code. We talk about what they are, how they work, the security benefits, some of the tools that make them possible, and we finish our conversation talking about developer empathy and why Ochaun has developer empathy as a result of some of the experiences that he has as a developer and as a security person....

Simon Bennetts -- Using OWASP Zap across an Enterprise

Simon Bennetts is the OWASP Zed Attack Proxy (ZAP) Project Leader and a Distinguished Engineer at StackHawk, a company that uses ZAP to help users fix application security bugs before they hit production. He has talked about and demonstrated ZAP at conferences all over the world. Prior to making a move into security, he was a developer for 25 years and strongly believes that you cannot build secure web applications without knowing how to attack them.Simon joins us for the second time to refresh our knowledge of Zap, explain how to use Zap as an automation tool in your pipeline,...

Timo Pagel -- DevSecOps Maturity Model

Timo Pagel has been in the IT industry for over fifteen years. After a system administrator and web developer career, he advises customers as a DevSecOps consultant and trainer. His focus is on security test automation for software and infrastructure and assessment of complex applications in the cloud.In his spare time, he teaches Web and Application Security at various universities. Timo joins us to talk about the OWASP DevSecOps Maturity Model or DSOMM. We explore maturity models, this specific one, how you can use it, and how to get started. We hope you enjoy this conversation with...Timo Pagel.FOLLOW OUR SOCIAL...

Mazin Ahmed -- Terraform Security

Mazin Ahmed is a security engineer that specializes in AppSec and offensive security. He is passionate about information security and has previously found vulnerabilities in Facebook, Twitter, Linkedin, and Oracle, to name a few. Mazin is the developer of several popular open-source security tools that have been integrated into security testing frameworks and distributions. Mazin also built FullHunt.io, the next-generation continuous attack surface security platform. He is also passionate about cloud security, where he has been running dozens of experiments in the cloud security world. Mazin joins us to introduce Infrastructure as Code and TerraForm and discuss the security benefits...

James Ransome and Brook Schoenfield -- trust and verify: Building in Security at Agile Speed

Dr. James Ransome is the Chief Scientist for CyberPhos, an early-stage cybersecurity startup. He is also a member of the board of directors for the Bay Area Chief Security Officer Council and serves as an adviser to ForAllSecure and Resilient Software Security.Dr. Ransome's career includes leadership positions in the private and public sectors. He has served in three chief information security officer and four chief security officer roles before taking on Chief Product Security Officer roles over the last 11 years. During this time, he has been building and enhancing developer-centric, self-sustaining, and scalable software security programs that are holistic,...

OWASP Top 10 2021 Peer Review

Robert and I break down the OWASP Top 10 2021 Peer Review Edition. We walk through and give you our insights and highlights of the things that stand out to us and our questions. We feel it brings value to our audience's understanding of the OWASP Top 10 2021 and what it will likely look like when it comes out. We encourage you to go and do your own peer review of the document, submit your own poll requests, provide your feedback and issues on Github because together as a community, this is how we make this document better. Enjoy!FOLLOW...

Anastasiia Voitova -- Encryption is easy, key management is hard

Anastasiia Voitova is the Head of customer solutions and a security software engineer at Cossack Labs. She works on data security and encryption tools and their integration into the real world apps.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Eran Kinsbruner -- DevSecOps Continuous Testing

Eran Kinsbruner is the Chief Evangelist and Senior Director at Perforce Software. His published books include the 2016 Amazon bestseller, The Digital Quality Handbook, Continuous Testing for DevOps Professionals, and Accelerating Software Quality ML and AI in the Age of DevOps. Eran is a recognized influencer on continuous testing and DevOps thought leadership, an international speaker, and blogger. Eran joins us to talk about the role of testing in a secure software pipeline. We talk about the intersection of security and quality, biggest challenges in getting started, and even a brief conversation about how SAST is used to check automotive...

Mark Loveless -- Threat modeling in a DevSecOps environment.

Mark Loveless - aka Simple Nomad - is a security researcher and hacker. He's spoken at numerous security and hacker conferences worldwide, including Blackhat, DEF CON, ShmooCon, and RSA. He's been quoted in the press including CNN, Washington Post, and the New York Times. Mark joins us to discuss his series of blog posts on Threat Modeling at GitLab. We discuss his philosophical approach, framework choice (spoiler alert, it's a pared down version of PASTA), and success stories / best practices he's seen for threat modeling success. We hope you enjoy this conversation with...Mark Loveless.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The...

Jeroen Willemsen -- Security automation with ci/cd

Jeroen Willemsen is a Principal Security Architect at Xebia. Jeroen is more or less a jack of all trades with an interest in infrastructure security, risk management, and application security. With a love for mobile security, he enjoys sharing knowledge on various security topics. Jeroen joins us to unpack security automation in a DevOps world. We discuss categories of tools, typical quick wins, potential downsides, and how dependency management specifically plays into automation. We hope you enjoy this conversation with...Jeroen Willemsen.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Thinking back, Looking forward - A Balanced Approach to Securing our Software Future

Kevin Greene is the Director of Security Solutions at Parasoft and has extensive experience and expertise in software security, cyber research and development, and DevOps. He leverages his knowledge to create meaningful solutions and technologies to improve software security practices. Kevin and I had a conversation to discuss software security from the past and into the future. We cover how to make security easier for developers, SBOM, software minimalism, cyber resiliency, and so much more! We hope you enjoy this conversation with...Kevin Greene.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jeevan Singh -- Threat modeling based in democracy

Jeevan Singh is a Security Engineer Manager at Segment, where he is embedding security into all aspects of the software development process. Jeevan enjoys building security culture within organizations and educating staff on security best practices. Before life in the security space, Jeevan had a wide variety of development and leadership roles over the past 15 years. Jeevan joins us to speak about self-serve threat modeling at Segment or threat modeling based in democracy. We discuss their focus with the program, how it fits in their dev methodology and their ultimate goal with the threat modeling program. We hope you...

Dima Kotik -- Application Security and the Zen of Python

Dima Kotik is an Application Security Engineer at Security Journey and has been programming in Python for years. As he was working on building out Security Journey's Secure Coding with Python content, he came across the Zen of Python, a set of guidelines for how to program in Python. He wrote a blog post about how to apply application security to the Zen of Python, and then we recorded this interview to talk about the concept in more depth. We hope you enjoy this interview with....Dima Kotik.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Dustin Lehr -- Advocating and being on the side of developers

Before taking the plunge into information security leadership, Dustin Lehr spent over a decade as a software engineer and architect in a variety of industries, including retail, DoD, and even video games. This diverse background has helped him forge close partnerships with development teams, engineering leaders, and software security advocates while pursuing the organizational culture shift of building good security habits into daily work. Dustin joins us to talk about the challenges developers face with security and so much more. We hope you enjoy this conversation with...Dustin Lehr.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Aaron Rinehart -- Security Chaos Engineering

Aaron Rinehart is expanding the possibilities of chaos engineering to cybersecurity. He began pioneering security in chaos engineering when he released ChaoSlingr during his tenure as Chief Security Architect at UnitedHealth Group (UHG). Rinehart is the O'Reilly Author on Security Chaos Engineering and has recently founded a chaos engineering startup called Verica with Casey Rosenthal from Netflix. Aaron joins us to explain what the heck security chaos engineering is. We explore the origin story of chaos engineering and security chaos engineering and how a listener starts with this new technique. We hope you enjoy this conversation with...Aaron Rinehart.FOLLOW OUR SOCIAL...

Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams

In this episode of the Application Security Podcast, we're joined by friends Izar and Matt, authors of the book "Threat Modeling: A Practical Guide for Development Teams." Izar is currently the Squarespace Principal Security Engineer. He lives in NY, where he enjoys telling people who separate security from development to get off his lawn. Matt is currently a Product & Application Security Engineer at Dell Technologies. Matt lives in Massachusetts, is an avid gamer, and enjoys time with his family when not thinking or talking to others about security. We discuss why they wrote the book, what it covers, the...

Charles Shirer -- The most positive person in security

Charles is a Senior Security Consultant for Red Siege. He has over 18 years of experience in IT. In his spare time, Charles does retro gaming and works on the SECBSD open source project, a penetration testing distro. He currently works as Staff at several Security Conferences, podcasts (GrumpyHackers) (Positively Blue Team Cast), and is a part of the MentalHealthHackers DeadPixelSec NovaHackers and HackingisNotaCrime Family. Charles joins us to talk about positivity in InfoSec. If you've never seen Charle's videos, you're missing out. We'll unpack what drives his positivity and how we as infosec / appsec people can embrace a...

Leif Dreizler -- Tactical tips to shift engineering right

Leif Dreizler is the manager of the Product Security team at Segment. Leif got his start in the security industry at Redspin doing security consulting work and was later an early employee at Bugcrowd. He helps organize the Bay Area OWASP Chapter, the LocoMocoSec Conference, and the AppSec California conference. Leif caught our attention when he published an article called Shifting Engineering Right: What security engineers can learn from DevSecOps. In this interview, we focus in on the tactical tips and takeaways from the article, or how you as a security person can shift engineering right. We hope you enjoy...

Vandana Verma -- OWASP Spotlight Series

Vandana Verma is the President of Infosec girls and Infosec Kids, a board of directors member for OWASP, and a leader for BSides Dehli. She joins us to introduce the OWASP Spotlight Series. With each video she creates, she highlights an OWASP project. We survey the projects she's covered and discuss a specific takeaway from each for the application security person. We hope you enjoy this conversation with...Vandana Verma.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Dr. Anita DAmico -- Do certain types of developers or teams write more secure code?

Dr. Anita DAmico is the CEO of Code Dx, which provides Application Security Orchestration and Correlation solutions to industry and government. Her roots are in experimental psychology and human factors. Her attention is now focused on enhancing the decisions and work processes of software developers and AppSec analysts to make code more secure. Anita joins us to discuss research she has done answering the question, "do certain types of developers or teams write more secure code?" Being a security culture fanatic, this topic is near and dear for me. We hope you enjoy this conversation with...Dr. Anita D'Amico.FOLLOW OUR SOCIAL...

Alyssa Miller -- Bringing security to DevOps and the CI/CD pipeline

Alyssa Miller is a life-long hacker, security advocate, and cybersecurity leader. She is the BISO for S&P Global ratings and has over 15 years of experience in security roles. She is heavily involved in the cybersecurity community as an international speaker, author, and advocate. Alyssa joins us to talk about bringing security to DevOps and the CI/CD pipeline. We talk about the success of the DevOps transformation, mistakes AppSec teams make with DevOps and explore the possible idea that DevSecOps is its own silo. We hope you enjoy this conversation with...Alyssa Miller.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube:...

Liran Tal Cloud native application security, whats a developer to do?

Liran Tal is an application security activist and long-time proponent of open-source software. He is a member of the Node.js security working group, an OWASP project lead, author of Essential Node.js Security, and OReillys Serverless Security. He is leading the developer advocacy team at Snyk in a mission to empower developers with better dev-first security. Liran joins us to talk about cloud-native and application security. We begin by defining cloud-native and the changes it is causing. We then get into threats in a cloud-native world and the role of developers and AppSec. We hope you enjoy this conversation with. Liran...

Chris Romeo DevSecOps Fails

For this episode, Robert and I decided to talk about an article I wrote called "DevOps security culture: 12 fails your team can learn from". We hope you enjoy this walkthrough of the 12 fails. If we missed any, hit us up on Twitter and let us know what we should add to the list.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jim Routh Secure software pipelines

Jim Routh has built software security programs at some of the biggest brands in the world. He has served as CISO or CSO six different times in his career, always staying close to his cyber and software security roots. Jim has hung up his CISO badge and now focuses on serving on boards and advising security-focused startups. Jims original AppSec podcast episode is our #1 listened to of all time. Having the opportunity to interact with Jim and absorb his vast wisdom and knowledge is a treat for everyone. At the end of this interview, my immediate thought was to...

Andrew van der Stock Taking Application Security to the Masses

Andrew van der Stock has been around the world of Application Security for quite a long time. In 2020, he took over as the Executive Director of OWASP, and he's working from within the organization to further the mission of taking application security to the masses. We discuss Andrew's OWASP origin story and he defines OWASP and the OWASP core mission. We talk membership, the future, and drop some details about the upcoming 20th anniversary of OWASP. We hope you enjoy this conversation with Andrew van der Stock.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

JC Herz and Steve Springett SBOMs and software supply chain assurance

JC Herz is the COO of Ion Channel, a software logistics and supply chain assurance platform for critical infrastructure. She is a visiting fellow at George Masons National Security Institute and co-chairs a Department of Commerce working group on software bills of materials for security-sensitive public and private sector enterprises. JC and Steve Springett join to talk all things software bill of materials. We define what an SBOM is and what its used for. We talk threats that SBOM counters, who started it, and what the OWASP tie in. JC concludes our time by explaining why now is the time...

Brian Reed Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021

Brian Reed is Chief Mobility Officer at NowSecure. Brian has over 30 years in tech and 15 years in mobile, security, and apps dating back to the birth of mobile including BlackBerry, Good Technology, BoxTone, and MicroFocus. Brian joins us to discuss mobile application security, the good, the bad, and the ugly as we head into 2021. We discuss recent issues in mobile apps, mobile firewalls, mobile vs. web, and how AppSec is different in a mobile world. We hope you enjoy this conversation withBrian Reed.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The Threat Modeling Manifesto Part 2

This is part two of the story of a diverse group of security and privacy people that love threat modeling and gathered to define threat modeling, encourage people to threat model, help them succeed, and change the world. This is our story of the Threat Modeling Manifesto. In this episode, we move on from definition to working through the values and principles that make up threat modeling, and then we ship the product.The working group of the Threat Modeling Manifesto consists of individuals with years of experience in threat modeling for security or privacy.Zoe BraitermanAdam ShostackJonathan MarcilStephen de VriesIrene MichlinKim...

The Threat Modeling Manifesto Part 1

This is part one of the story of a diverse group of security and privacy people that love threat modeling and gathered to define threat modeling, encourage people to threat model, help them succeed, and change the world. This is our story of the Threat Modeling Manifesto. Our intention is to share a distilled version of our collective threat modeling knowledge in a way that should inform, educate, and inspire other practitioners to adopt threat modeling as well as improve security and privacy during development.We developed this Manifesto after years of experience thinking about, performing, teaching, and developing the practice...

Season 7 Guests The best of Season 7

This is our final episode of Season 7, and we thought we'd share some of our favorite clips with you. We've covered lots of ground, from featuring many OWASP projects to DevSecOps, penetration testing, AWS security, SameSite cookies, crypto, and that just scratches the surface. We hope you enjoy this wrap-up episode with.... A whole bunch of Season 7 guests.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Aviat Jean-Baptiste The AppSec report

Jb Aviat is CTO and co-founder at Sqreen. Prior to this, Jb worked at Apple as a reverse engineer, pentester, and developer. Jb joins us to discuss the new Application Security Report that Sqreen has released. We review what the report contains, key takeaways and conclusions, and even consider which framework/language is the most secure. We hope you enjoy this conversation with. Jb Aviat.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Frank Rietta The convergence of Ruby on Rails and #AppSec

Frank Rietta is the CEO of Rietta.com, a Security Focused Web Application Firm. He is a web application security architect, expert witness, author, and speaker. Frank joins us to discuss secure coding with Ruby on Rails. We get into a discussion about RoR vs. other languages, primary threats, counters to threats, and tools available for the RoR developer to assist with security. We hope you enjoy this conversation with Frank Rietta.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Dmitry Sotnikov REST API Security there is no silver bullet

Dmitry Sotnikov serves as Chief Product Officer at 42Crunch an enterprise API security company. He maintains https://APISecurity.io, a popular community site with daily API Security news and weekly newsletter API vulnerabilities, breaches, standards, best practices, regulations, and tools. Dmitry joins us to discuss REST API Security. We talk about the top API security threats, counters to those threats, and the details on APISecurity.IO. We hope you enjoy this conversation with Dmitry Sotnikov.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Caroline Wong The state of Penetration Testing

Caroline Wong is the Chief Strategy Officer at Cobalt.io. Wong's close and practical information security knowledge stems from broad experience as a Cigital consultant, a Symantec Product Manager, and day-to-day leadership roles at eBay and Zynga. Caroline joins us to talk about penetration testing and reviews key findings from the Cobalt.io "State of Pentesting" report. We hope you enjoy Caroline Wongs second visit to the Application Security Podcast.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Aaron Davis LavaMoat solving JavaScript software supply chain

Aaron Davis is a founder, dev, and a lead security researcher at MetaMask, a popular Ethereum wallet. He introduces us to LavaMoat, an approach to solving javascript software supply chain security for node and the browser. The LavaMoat runtime prevents modifying JavaScript's primordials, limits access to the platform API, and prevents packages from corrupting other packages. We hope you enjoy this conversation with Aaron Davis.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Anastasiia Voitova Use Cryptography; Dont Learn It

Anastasiia Voitova is a software engineer who works on data security solutions at @cossacklabs, making complex crypto easy-to-use in modern software. She joins us to explore the idea of boring crypto. She caught our attention with a talk at OWASP 24 where she encouraged developers to NOT learn crypto. You'll have to listen to understand her rationale. She explains mistakes folks make with crypto, boring crypto, and how to get started implementing boring crypto. We hope you enjoy this conversation withAnastasiia Voitova.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Michael Furman SameSite Cookies

Michael Furman is the Lead Security Architect at Tufin, and is responsible for the security and Security Development Lifecycle (SDL) of Tufin software products. Michael is passionate about application security for over 13 years already and evangelizes about application security at various conferences (including OWASP conferences) and security meetups. Michael joins us to break down SameSite cookies, which are all the rage in browsers these days. He describes what they are, the threats they counter, and how SameSite + the Synchronizer Token Pattern work together to counter CSRF. We hope you enjoy this conversation with. Michael Furman.FOLLOW OUR SOCIAL MEDIA:Twitter:...

Chris Romeo The State of Security and the Importance of Empathy

Application security applies to everyone, network architects included. Chris had an opportunity to join a friend's Podcast called "The Hedge." Chris talks with hosts Tom and Russ about the state of security and what network engineers need to know about security from an application perspective. They talk about the importance of empathy in all jobs, walking a mile in the shoes of those that work around you.Youll find this episode on the Hedge site at https://rule11.tech/hedge-048/.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Neil Matatall Content Security Policy

Neil Matatall is a product security engineer at GitHub. He focuses on designing and engineering user experiences solutions related to authentication and account recovery. Working remotely from Hawaii, Neil is a strong believer in the future of remote work. Neil joins us for a deep-dive into Content Security Policy. We explore what it is, the purpose, and why its so difficult to implement.We hope you enjoy this conversation with Neil Matatall.https://github.com/github/secure_headersFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Grant Ongers Gamification of threat modeling

Grant Ongers is co-founder of the bearded trio called Secure Delivery, with a philosophy and purpose for optimal delivery and security in one dynamic package. Grant's experience spans Dev, Ops, and Security, with over 30 years pushing the limits of (Info)Sec. Grants community involvement is global: Staff at BSides (London, Las Vegas, and Cape Town), Goon at DEF CON (USA) for nearly ten years and DC2721 co-founder, staff at BlackHat (USA and EU), and an OWASP Global Board member.Grant joins us to talk about gamification and threat modeling, and introduces me to the OWASP Cornucopia card game, which you can...

Elie Saad OWASP WSTG, Cheat Sheets, and Integration

Elie Saad is an application security engineer, leading three different OWASP projects. He focuses on helping developers own and champion security in their projects by providing guidance, tests, secure pipeline design and aiding them in applying external security measures. In this conversation, Elie educates us about the current happenings with WSTG, Cheat Sheets, and the Integration Standard. He walks us through demos of each project.We hope you enjoy this conversation with Elie Saad. @7hundersonFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Graham Holmes Adversarial Machine Learning

Graham Holmes is the founder and owner of AoP CyberSecurity, LLC whose mission is to enable organizations to create scalable and effective strategies for trustworthy outcomes. His career includes over 22 years as a leader at Cisco Systems, where he infamously served as my boss for a period of time, and before that he served in the US Navy as a commissioned officer for 9 years. Graham joins us to discuss adversarial machine learning. We explore the threats and attacks in an AI/ML world, and review solutions to address these challenges using trust as a foundation. Please enjoy this conversation...

Ochaun Marshall Securing Web applications in AWS

Ochaun Marshall is a developer and security consultant. In his roles at Secure Ideas, he works on ongoing development projects utilizing Amazon Web Services and breaks other people's web applications. Ochaun joins us to talk about the changing tide of serverless and frustrations with AWS security. Before we got to the actual topic, we talked about how he currently works as a developer some times, and a pen tester/security person the rest of the time, and the conflict that arises from this split role. Please enjoy this conversation withOchaun Marshall.@OchaunMFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for...

Drew Dennison Security should make the computer sweat more

Drew Dennison is the CTO & co-founder of r2c, a startup working to profoundly improve software security and reliability to safeguard human progress. Drew joins us to introduce a tool called semgrep. Semgrep is a fast source code analysis tool, potentially faster than anything you've seen before. If you want to see the live demo of semgrep, head over to the Application Security Podcast Youtube channel to see the video.We hope you enjoy this conversation with Drew Dennison.Twitter: DrewDennisonFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Aaron Guzman IoTGoat

Aaron Guzman specializes in IoT, embedded, and automotive security. Aaron is the Co-Author of IoT Penetration Testing Cookbook. He helps lead both OWASPs Embedded Application Security and Internet of Things projects; providing practical guidance for addressing top security vulnerabilities to the embedded and IoT community. Aaron joins us to explore IoTGoat. IoTGoat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices. He describes what it is, where it comes from, and does a demo for us on how to put it to use.For season 7 and beyond, weve...

Adam Shostack The Jenga View of Threat Modeling

Adam Shostack is a leading expert on threat modeling, and consultant, entrepreneur, technologist, author, and game designer. He has taught threat modeling at a wide range of commercial, non-profit, and government organizations. Adam joins us to discuss his new white paper called the Jenga View of Threat Modeling. For season 7 and beyond, we've launched our YouTube channel, Application Security Podcast, where we post the video feeds for all episodes. Youll want to check it out, as many interviews now have demos included, where we capture a screen during the interview.You can grab a copy of the whitepaper on Adams...

Cindy Blake Aligning security testing with Agile development

Cindy Blake is the Senior Security Evangelist at GitLab. Cindy collaborates around best practices for integrated DevSecOps application security solutions with major enterprises. She is proud to introduce her new book, 10 Steps to Securing Next-Gen Software. The book combines her cyber security experience with a background in lean and software development, and simplifies the complexities of todays software evolution into pragmatic advice for security programs. Cindy joins us to discuss how to align security testing with Agile development.For season 7 and beyond, weve launched our YouTube channel, Application Security Podcast, where we post the video feeds for all episodes....

Jannik Hollenbach Multijuicer: JuiceShop with a side of Kubernetes

Jannik Hollenbach is a Security Automation Engineer at iteratec GmbH, working on and with open source security testing tools to continuously detect security vulnerabilities in the companies software and systems. He is also a member of the OWASP Juice Shop project team. Jannik joins us to discuss MultiJuicer, or how to run JuiceShop in a Kubernetes cluster, with a separate JuiceShop instance for each user.For season 7 and beyond, weve launched our Youtube channel, Application Security Podcast, where we post the video feeds for all episodes. Youll want to check it out, as many interviews now have demos included, where...

Sebastien Deleersnyder and Bart De Win OWASP SAMM

Sebastien Deleersnyder is co-founder, CEO of Toreon, and Bart De Win is a director within PwC Belgium. They work together to co-lead both the OWASP Belgium Chapter and the OWASP SAMM project. Sebastien and Bart join us to introduce OWASP SAMM 2.0. OWASP SAMM (Software Assurance Maturity Model) is the OWASP framework to help organizations assess, formulate, and implement a strategy for software security they can integrate into an existing Software Development Lifecycle (SDLC). We explore where it came from, and walk through the framework.For season 7 and beyond, weve launched our Youtube channel, Application Security Podcast, where we post...

Marc French, Steve Lipner, Maya Kaczorowski, DJ Schleen, Kim Wuyts Season Six Wrap up

Weve reached the end of season six, and here are a few of our favorite clips. Season seven is around the corner.S06E01 Marc French The AppSec CISOWhat are some tips for someone who wants to become a CISO? Is there such a thing as a CISO school?S06E05 Steve Lipner The Past, Present, and Future of SDLLipner is a giant in the industry and someone that Ive looked up to for years. After some setup, I ask him for a definition of SDL.S06E08 Maya Kaczorowski Container and Orchestration SecurityContainers are not a security tool. Do you agree or disagree? The philosophy...

Mark Merkow Secure, Resilient, and Agile Software Development

Mark Merkow works at WageWorks in Tempe, Arizona, leading application security architecture and engineering efforts in the office of the CISO. Mark has over 40 years of experience in IT in a variety of roles, including application development, systems analysis, and design, security engineering, and security management. Mark has authored or co-authored 17 books on IT and has been a contributing editor to four others.Mark joins us to discuss how application security and Agile software development methodology fit together. We hope you enjoy this conversation with Mark Merkow.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Zsolt Imre Fuzz testing is easy

Zsolt is the founder and CTO of GUARDARA with more than 15 years of experience in cybersecurity, both on the offensive and defensive side. Zsolt explains fuzz testing, who does it, and why. He also helps us to understand how to deal with fuzz testing results, and how to get started doing fuzz testing on your own. We hope you enjoy this conversation with Zolt Imre.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Adam Shostack Remote Threat Modeling

Adam joins us to discuss remote threat modeling, and we do a live threat modeling exercise to figure out how remote threat modeling actually works. If you want to see the screen share as we figure out remote threat modeling, check out the Youtube version of the episode. Bio: Adam Shostack is a leading expert on threat modeling, and consultant, entrepreneur, technologist, author and game designer. He has taught threat modeling at a wide range of commercial, non-profit and government organizations. Hes a member of the Black Hat Review Board, is the author of Threat Modeling: Designing for Security, and...

Kim Wuyts Privacy Threat Modeling

Kim Wuyts is a postdoctoral researcher at the Department of Computer Science at KU Leuven (Belgium). She has more than 10 years of experience in security and privacy in software engineering. Kim is one of the main forces behind the development and extension of LINDDUN, a privacy threat modeling framework that provides systematic support to elicit and mitigate privacy threats in software systems. Kim joins us to explain the difference between security and privacy and introduce us to LINDDUN and how to use it.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

John Martin Preventing a Cyberpocalypse

John Martin has owned responsibilities ranging from Software Supply Chain to DevSecOps Security Champions to Cloud Security Monitoring. His career spans the years between Blue-Box MF generators, through the era of automated hacks, and into our modern age of industrialized paranoia. He is a frequent speaker on the topic of commercial software security and a contributor to many SAFECode and CSA efforts. John joins us to discuss the prevention of a cyberpocalypse. You heard it correctly. Now tune in to learn what a cyberpocalypse is and why you need to care about it. We hope you enjoy this conversation with...

Jeremy Long Its dependency check, not checker

Jeremy Long is a principal engineer specializing in securing the SDLC. Jeremy is the founder and project lead for the OWASP dependency-check project; a software composition analysis tool that identifies known vulnerable 3rd party libraries. Jeremy joins us to share the origin story of dependency check, the problems it solves, the number of companies that use it, how to integrate it, and the future of the project.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Alyssa Miller Experiences with DevOps + Automation and beyond

Alyssa is a hacker, security evangelist, cybersecurity professional and international public speaker with almost 15 years of experience in the security industry. A former developer, her background is application security, not only conducting technical assessments but also helping develop complete security programs. Alyssa joins us to share her take on DevOps, automation, and beyond. She also shares a great story about how she got domain admin in 3 minutes.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vandana Verma Support each other

Vandana Verma is a passionate advocate for application security. From serving on the OWASP Board to running various groups promoting security to organizing conferences, she is engaged in making the global application security community a better place. She manages the @Infosecgirls organization and is a leader for the @OWASPBangalore chapter. Vandana joins us to discuss her work so far on the OWASP Board, to discuss her AppSec DC keynote on diversity, and to catch us up on InfoSecGirls and WIA.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

DJ Schleen DevOps: The Sec is Silent

DJ Schleen is a seasoned DevSecOps advocate at Sonatype and provides thought leadership to organizations looking to integrate security into their DevOps practices. He encourages organizations to deeply integrate a culture of security and trust into their core values and product development journey. DJ joins us to talk about the philosophy of DevOps and flow, DevSecOps and silos, and the DevSecOps reference architectures. We hope you enjoy this conversation with DJ Schleen.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Niels Tanis 3rd Party Risk in a .NET World

Niels Tanis has a background in .NET development, pen-testing, and security consultancy. He has experience breaking, defending and building secure applications. Neils joins us to continue our .NET conversation from last year. This time around we focus on the 3rd party risk we pull into our applications by using third party libraries in a .NET conversation from last year. This time around we focus on the 3rd party risk we pull into our applications by using third party libraries in a .NET world.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Maya Kaczorowski Container and Orchestration Security

Maya is a Product Manager in Security & Privacy at Google, focused on container security. She previously worked on encryption at rest and encryption key management. Maya has a Master's in mathematics, focusing on cryptography and game theory. Maya joins us to discuss how containers improve security, a high-level threat model of containers and orchestration, and tips for enhancing security as you role out containers and Kubernetes.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Geoff Hill AppSec, DevSecOps, and Diplomacy

Geoffrey Hill is an AppSec DevSecOps leader and Architect. Geoff joins us to discuss his experiences rolling out DevSecOps in both Agile and non-Agile practicing shops. We hope you enjoy this conversation with...Geoff Hill.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Erez Yalon The OWASP API Security Project

Erez Yalon heads the security research group at Checkmarx. With vast defender and attacker experience and as an independent security researcher, he brings invaluable knowledge and skills to the table. Erez joins us to speak about the new OWASP API Security Project, and more specifically, the new API Security Top 10. We hope you enjoy this conversation with Erez Yalon.Find the Document on the OWASP GitHub: https://github.com/OWASP/API-SecurityFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Steve Lipner The Past, Present, and Future of SDL

Steve Lipner is a pioneer in cybersecurity, approaching 50 years experience. He retired in 2015 from Microsoft where he was the creator and long-time leader of Microsofts Security Development Lifecycle (SDL) team. While at Microsoft, Steve also created initiatives to encourage industry adoption of secure development practices and the SDL and served as a member and chair of the SAFECode board. Steve joins us to talk about all things SDL, and I must say, I was super excited for this interview, with way too many questions for someone who was there on day 1 of Secure Development Lifecycle. We hope...

David Kosorok The Three Pillars of an AppSec Program: Prevent, Detect, and React

David Kosorok is a code security expert, software tester, father of 9, and a self-described major nerd. David is the Director of AppSec at Align Tech, and a fellow member of the Raleigh Durham tech community. David joins us to speak about the three pillars of building an application security program: Prevent, Detect, and React. When we think the program, weve never heard anyone relate a program this way, and thought you needed to hear about a different approach to program building. We hope you enjoy this conversation with. David Kosorok.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks...

Chris and Robert: A Taste of Hi-5

As the hosts of the Application Security Podcast, we get the opportunity from time to time to mix it up. This week we gather a few security articles, share a summary, and offer our opinions (for what our opinions are worth). The source of the articles is Hi-5, a weekly newsletter containing five security articles that are worth your time. We scour the Interwebs looking for the best articles on application and product security and share those with you. You can subscribe to Hi-5 on the Security Journey website.Hit us up on Twitter and let us know if you like...

Bill Dougherty INCLUDES NO DIRT, practical threat modeling for healthcare and beyond

Bill Dougherty is the vice president of IT and security at Omada Health, where he leads a team responsible for all aspects of internal IT including SaaS strategy, end-user support, vendor management, operational security and compliance. Bill along with Patrick Curry created the INCLUDES NO DIRT approach to threat modeling, which takes threat modeling to the next level, beyond STRIDE, and goes head on with a more modern set of real-world security considerations. We hope you enjoy this conversation with, Bill Dougherty.Find Bill on Twitter @bdognet.For an article about the methodology, see INCLUDES NO DIRT: A Practical Threat Modeling Approach...

Marc French The AppSec CISO

Marc French is a security person, firearms geek, scuba guy, lousy golfer, and an aspiring blacksmith. We met Marc in the hallway at the Boston Application Security Conference. Marc has extensive experience as a CISO but came from the world of AppSec to the exec suite, which is not the normal path. We discuss what is a CISO, and what does a CISO actually do, the role of AppSec in the life of the CISO, and tips Marc has for those that wish to become a CISO someday. We hope you enjoy this conversation with Marc French.FOLLOW OUR SOCIAL MEDIA:Twitter:...

Season 5 Finale A cross section of #AppSec

Threat modeling, secrets, mentoring, self-care, program building, and much more. Clips from Georgia Weidman, Simon Bennetts, Izar Tarandach, Omer Levi Hevroni, Tanya Janca, Bjrn Kimminich, Caroline Wong, Adam Shostack, Steve Springett, Matt McGrath, Brook Schoenfield, and Ronnie Flathers.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ronnie Flathers Security programs big and small

Ronnie Flathers is a security guy, a pentester, and a researcher. In this conversation, we explore his experiences in building application security programs. He's had the opportunity to program build inside of companies big and small.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Brook Schoenfield Security is a messy problem

Brook Schoenfield is a Master Security Architect @IOActive and author of Securing Systems, as well as an industry leader in security architecture and threat modeling, and a friend. "We have a static analysis tool. Why do we need a program?" This is what Brook overheard at one point in his past, from a company CTO, and it sums up the program issue. The CTO was trying to drive a technical strategy for an entire company, and security was just one piece of that. A mandate or a tool would have made life so easy.Brook takes us on a journey based...

Liran Tal The state of open source software security

Liran Tal is a Developer Advocate @snyksec and is the author of Essential Node.js Security. He takes #opensource and protecting the #web very seriously. Liran and I start by geeking out about BBS's in the days of old. SYSOP page, anyone? Then we go into the state of open source security based on the report that Liran contributed heavily to and discuss many of the key takeaways from that report, including the developer response to open source security, security vulnerability rates in docker containers, and the length of time that vulnerabilities lie dormant in open source. We close out with...

Liran Tal Open Source Security 5 Minute AppSec

Why should someone care about open source security?FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Steve Springett An insiders checklist for Software Composition Analysis

Steve Springett is a technologist, husband, father, entrepreneur, and tequila aficionado. He is the creator of the OWASP @DependencyTrack and @CycloneDX_Spec. In this conversation, we begin with the problem of software supply chain risk and the failures of commercial Software Composition Analysis tools. We then go through an extensive list of criteria for purchasing a software composition analysis tool. I have never seen a list like this ever shared anywhere in the industry. Steve is definitely in the know when it comes to these types of tools, and this is a detailed checklist of what he looks for in a...

Steve Springett OWASP Dependency Track 5 Minute AppSec

The question is for Steve Springett, in regards to Software Composition Analysis / Software Supply Chain and OWASP Dependency Track.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Elissa Shevinsky Static Analysis early and often

Elissa Shevinsky is CEO at Faster Than Light. She's had a storied career as an entrepreneur with Brave, Everyday Health, and Geekcorps. We discuss Elissa's origin story, security startups, and the value of mentoring to her career. Then we get into Static Analysis and how we make security easier for people so that security gets done.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Elissa Shevinsky Be Kind, Security People 5 Minute AppSec

Robert asks Elissa Shevinsky, why should people be nice, or why is niceness important in security?FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Matt McGrath Security coaches

Matt McGrath is an old school Java developer that made the transition into security. Matt has had success in rolling out a programmatic approach to security improvement called security coaching. A security coach is much more than a wellness or life coach for your developers. They have some commonalities, but the security coach is thinking about how you help the developer want to get better at security. In his experience, developers are not going to kick and scream away from security but will embrace it when asked.The job description for a good coach does not require a development background. The...

Erez Yalon and Liora Herman The Application Security Village @ DefCon

Erez Yalon and Liora Herman are both passionate security professionals. They joined forces to create the AppSec Village, an event at DefCon in Las Vegas. If you are in Vegas for BH/DC, stop by the village and say hi to Robert, who will be in attendance as well.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Erez Yalon AppSec Village 5 Minute AppSec

It's BlackHat and DefCon season, so we asked a question of Erez Yalon; why did you start the AppSec Village?FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Tommy Ross The BSA Framework for Secure Software

Tommy Ross serves as Senior Director, Policy with BSA | The Software Alliance. In this role, he works with BSA members to develop and advance global policy positions on a range of key issues, with a focus on cybersecurity, privacy, and market access barriers. Tommy is one of the coordinators/collaborators on the BSA Framework for Secure Software. This document caught our attention when it came out a few months ago, as it is a reliable representation of all the pieces an organization needs for software security. Tommy shares with us some of the background stories on how this document came...

Adam Shostack Threat modeling layer 8 and conflict modeling

Adam Shostack is a leading expert on threat modeling, and a consultant, entrepreneur, technologist, author and game designer. He's a member of the BlackHat Review Board and helped create the CVE and many other things. He currently helps many organizations improve their security via Shostack & Associates, and advises startups. Adam is known for his work with threat modeling. In this episode, we take threat modeling to a whole new level as we explore the idea of threat modeling layer 8 or human beings, and explore the concept of conflict modeling.Youll find Adams conflict modeling work on GitHub.https://github.com/adamshostack/conflictmodelingFOLLOW OUR SOCIAL...

Adam Shostack Threat Modeling 5 Minute AppSec

If you've done anything with threat modeling, you've heard of Adam Shostack. We asked him the question, "why would anyone threat model?".FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Zoe Braiterman AI, ML, AppSec, and a dose of data protection

Zoe Braiterman is an Innovation Intelligence Strategist focused on both the Machine and Human and also the OWASP WIA Chair. We explore the intersection of application security with artificial intelligence and machine learning and end up discussing data protection. Zoe approaches AppSec from a different angle, and her perspectives get us thinking about the importance of appsec in the future of autonomous everything.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Caroline Wong Self-care and self-aware for security people

Caroline Wong has had a long career in security, starting with eBay and leading to her role today at Cobalt.IO as Chief Strategist. Caroline shares her explanation of self-care and tells her story about how neglecting self-care led to problems. She offers ideas about how to better approach self-care as a security professional, work-life balance, and ways for approaching a successful career in security.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Bjrn Kimminich The new JuiceShop, GSOC, and Open Security Summit

Bjrn Kimminich is the project leader for OWASP JuiceShop. This is his second visit to the podcast, and we discuss new features in JuiceShop, including XSS in jingle promo video, marketing campaign coupon hacking, GDPR related features and challenges, working 2FA with TOTP, and the DLP failure challenges. Then we get into the cool new things that will come as a result of the GSoC, where a developer will add new functionality to the JS where new vulns can be hidden. We end discussing the upcoming Open Security Summit from OWASP.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks...

Bjrn Kimminich JuiceShop 5 minute AppSec

Bjrn Kimminich is the project leader for OWASP JuiceShop. He created JuiceShop out of necessity, after reviewing all the available vulnerable web apps years ago, and not finding what he needed. OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security training, awareness demos, CTFs, and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications!FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Nancy Garich and Tanya Janca DevSlop, the movement

Nancy Garich and Tanya Janca are two of the project leaders for the OWASP DevSlop Project. As we learn more about DevSlop, we realize that it is much more than a project: it's a movement. DevSlop is about the learning and sharing of four awesome women and is a platform for them to share what theyve learned with the community.DevSlop consists of four different modules:Patty An Azure DevSecOps pipelinePixi-CRS & Pixi-CRS-ZAP are two Circle-CI pipelines that demonstrate adding a WAF to your pipeline for automatic tuning before moving your apps to prodPixi is an intentionally vulnerable app and consists of...

Tanya Janca Mentoring Monday 5 Minute AppSec

Tanya Janca is excited about mentoring. She's started a hashtag on Twitter for mentors to find mentee's, and for mentee's to search for mentors. Mentoring is such an essential part of growing our community, so if you are not mentoring anyone today, I can only ask, why not? Here is Tanya's take on mentoring and her advice on how to get involved with #MentoringMonday.5 Minute AppSec is an AppSec Podcast experiment with micro-content. Hit us up on Twitter and tell us what you think, @AppSecPodcast.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Matt Clapham A perspective on appsec from the world of medical software

Matt Clapham is a product security person, as a developer, security engineer, advisor, and manager. He began his career as a software tester, which led him down the path of figuring out how to break things. Matt lives in the medical software world and visited the Healthcare Information and Management Systems Society (HIMSS) conference. Matt shares his perspectives on application/cybersecurity through the eyes of the healthcare industry. There is much for us to understand by viewing how other segments approach security and privacy. Matt believes in stepping outside the echo chamber and experiencing how other industries see security, and he...

Jon McCoy Hacker outreach

Jon McCoy is a security engineer, a developer, and a hacker; and a passionate OWASP advocate. Maybe even a hacker first. Jon has a passion to connect people and break down barriers between hackers and corporate folks. Jon explains the idea of hacker outreach and breaks down what we can expect if we venture to the DefCon event in Las Vegas. Jon also remembered a cautionary tale of Roberts Fitbit out at a DefCon event. Jon is someone we can all learn from about giving back to our community.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Omer Levi Hevroni K8s can keep a secret?

Omer Levi Hevroni has written extensively on the topic of Kubernetes and secrets, and he's a super dev. He's the author of a tool for secrets management called Kamus. Kamus is an open source, GitOps, zero-trust secrets encryption and decryption solution for Kubernetes applications. Kamus enables users to easily encrypt secrets that can be decrypted only by the application running on Kubernetes. The encryption is done using strong encryption providers (currently supported: Azure KeyVault, Google Cloud KMS, and AES).Find Omer on Twitter to converse about all things K8s and secrets.Show notes:https://blog.solutotlv.com/can-kubernetes-keep-a-secret/https://github.com/Soluto/kamusFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks...

Izar Tarandach Command line threat modeling with pytm

Izar Tarandach is a threat modeling pioneer, seen as one of the movers and shakers in the threat modeling world. Izar leads a small team that develops the pytm tool, which is self-described as a "A Pythonic framework for threat modeling". The GitHub page goes on to say define your system in Python using the elements and properties described in the pytm framework. Based on your definition, pytm can generate, a Data Flow Diagram (DFD), a Sequence Diagram and most important of all, threats to your system.Reach out to Izar on Twitter and visit the pytm GitHub page to download...

Simon Bennetts OWASP ZAP: past, present, and future

Simon Bennetts is the project leader for OWASP ZAP. Simon joined Robert at CodeMash to talk about the origin of ZAP, the new heads up display, and ZAP API. ZAP is an OWASP FlagShip Project and is available here: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_ProjectFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Bill Sempf Growing AppSec People and KidzMash

Robert meets up with Bill Sempf at the CodeMash conference and discusses how to grow AppSec people. Developers can transform into application security people. They also cover how to inspire the next generation of cybersecurity people (kids) through the example of KidzMash.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Georgia Weidman Mobile, IoT, and Pen Testing

Georgia Weidman (@georgiaweidman) met with Robert at CodeMash to discuss her origin story, mobile, IoT, penetration testing, and details about her various companies. If you've never seen Georgia's book on penetration testing, we recommend you grab a copy. http://www.nostarch.com/pentesting To sign up for the newsletter mentioned at the start of this week's show, visithttps://info.securityjourney.com/hi5signupFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Conclusion: Season 4 Finale

Here it is. The finale of season four. Thanks to everyone who listens in, and remember, if there are any people you want us to interview on the podcast, tweet at us @AppSecPodcastFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Geoff Hill -- Rapid Threat Model Prototyping Process

Geoff Hill joins Chris and Robert to talk about Rapid Threat Model Prototyping Process. You can find Geoff on Twitter @Tutamantic_SecFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Bill Wilder -- Running Azure Securely

Bill Wilder joins Chris and Robert to talk about Running Azure Securely. You can find Bill on Twitter @codingoutloudFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Matt Konda -- OWASP Glue

Matt Konda joins Chris and Robert to talk about what Glue is.You can find Matt on Twitter @mkondaOWASP GlueFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Josh Grossman, Avi Douglen, and Ofer Maor -- AppSec in Israel and Three Talks to watch from AppSec USA

Josh Grossman, Avi Douglen, and Ofer Maor at AppSec USA join Chris. They discuss the AppSec group in Israel and a few critical talks you should watch from AppSec USA this year.You can find Josh on Twitter @JoshCGrossmanYou can find Avi on Twitter @sec_tiggerYou can find Ofer on Twitter @OferMaorFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Daniel Miessler -- OWASP IoT Top 10

Daniel Miessler joins Chris and Robert to talk about the upcoming Top 10 list for IoT.You can find Daniel on Twitter @DanielMiesslerIoT ProjectFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Travis McPeak -- SecOps Makes Developers Lives Easier

Travis McPeak joins Chris to talk about SecOps and how it can help make a developer's life easier.You can find Travis on Twitter @travismcpeakFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo

We listen in on the #AppSecUSA talk by Chris about Security Culture Hacking.You can find Chris on Twitter @edgeroute FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jim Manico -- The Extremely Unabridged History of SQLi and XSS

Jim Manico joins again to talk about how AppSec has changed over the years and gives us an in-depth look at the history of SQL Injection and XSS.You can find Jim on Twitter @manicodeFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jeff Williams -- The History of OWASP

Chris talks with Jeff Williams about the History of OWASP and where it came from.You can find Jeff on Twitter @planetlevelFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Bjorn Kimminich -- The Joy of the Vulnerable Web: JuiceShop

Bjorn Kimminich joins to talk about JuiceShop. He dives into what JuiceShop is and some of its use cases.You can find Bjorn on Twitter @bkimminichFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing

Chris is at AppSec USA and is joined by Swaroop to talk about iGoat. They discuss how iGoat relates to WebGoat and how they can be used for pen testing.You can find Swaroop on Twitter @swaroopsyFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program

Chris and Robert talk with Adam and John from HackerOne about Bug Bounty. They dive into bug bounty from the programming and security researcher sides to show how you can combine these pieces with being successful with a bug bounty.You can find Adam on Twitter @SushiHack and Jon @jon_bottariniFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Erlend Oftedal -- What You Require, You Must Also Retire

Chris talks with Erlend Oftedal about the Norway Chapter of OWASP and continues on to what retire.js is and how it works.You can find Erlend on Twitter @webtonullFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Abhay Bhargav -- Threat Modeling as Code

Abhay Bhargav joins Robert to talk about threat modeling as code. He dives into how this can help you in your threat models.You can find Abhay on Twitter @abhaybhargavFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Tony UV -- Threat Libraries in the Cloud

Tony UV joins Robert to discuss all things threat libraries in the cloud.You can find Tony on Twitter @t0nyuvFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Aaron Rinehart -- Chaos Engineering and #AppSec

Chris and Robert talk to Aaron Rinehart about how the security community can embrace chaos engineering.You can find Aaron on Twitter @aaronrinehartFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jessica Robinson and Vandana Verma-- WIA: Women in #AppSec

Jessie and Vandana join Chris from Women in #AppSec to discuss the project! They dive into what the project is and how the numerous OWASP Chapters around the world can participate!You can find them on Twitter @InfosecVandana and @jessrobin96FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Karen Staley -- A Conversation with Karen

This week we're joined by Karen Staley, the Executive Director of the OWASP Foundation. She dives into what's happening on OWASP and what we can look forward to in the future.You can find her on Twitter @owaspedFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mohammed Imran -- Back to the Lab Again with a DevOps

Mohammed Imran joins us to discuss the DevSecOps Studio and more about the beautiful world of DevOps.You can find him on Twitter @secfigoFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Niels Tanis -- A Slice of the Razor with ASP.Net Core

Niels Tanis joins to talk about Razor and ASP.Net Core versus General.You can find Niels on Twitter @nielstanisFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ofer Maor -- A Pen Testers Transition to #AppSec: #VoteForOfer

Chris is joined by Ofer Maor to talk about his journey of transitioning into the world of #AppSec from the world of Pen Testing.You can find him on Twitter @OferMaorFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Matt Tesauro -- #AppSec Pipeline as Toolbox

We're joined by Matt Tesauro, a co-lead for the AppSec Pipeline Project. He explains how they began building this project and some ways for you to start using this in your organization.You can find Matt on Twitter @matt_tesauroFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Stephen de Vries -- Threat Modeling with a bit of #Startup

Stephen de Vries joins to discuss Threat Modeling and the unique approach that he takes by using tooling. We also discuss application security and startups.You can find Stephen on Twitter @stephendvFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Julien Vehent -- Securing DevOps

Julien Vehent joins us to discuss all things DevOps + Security. We talk through Julien's new book, Securing DevOps, and go in-depth about his journey to building security into DevOps at his job.You can find Julien on Twitter @jvehentVisit Manning PublicationsFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Christian Folini -- CRS and an Abstraction Layer

Christian Folini joins Chris at AppSec EU for this episode about ModSecurity and the Core Rule Set project from OWASP. They dive into the timeline for the abstraction layer piece of the project and much more.You can find Christian on Twitter @ChrFolini.OWASP ModSecurity Core Rule SetModSecurityFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Sean Wright -- Google Chrome and the Case of the Disappearing HTTP

Sean Wright joins Chris to discuss the changes Google made to handle the HTTP Protocol. They also dive into TLS and some other pieces of crypto that relate to #AppSec.You can find Sean on Twitter @SeanWrightSecFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Conclusion: All the Pieces You Need for an #AppSec Program

The conclusion of Season 3, all the best highlights, and some great advice from our guests on what you need to build an #AppSec Program.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Martin Knobloch -- OWASP, Reach Out; We Are Known and Misunderstood

Martin Knobloch joins Chris and Robert to discuss all things OWASP. They dive into the history of OWASP and some of the plans for the future.You can find Martin on Twitter @knoblochmartin.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Devin McMasters -- Bug Bounty with a Side of Empathy

Devin McMasters joins Chris to talk about bug bounties and how to make them successful.You can find Devin on Twitter @DevinMcmastersFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Apollo Clark -- Malicious User Stories

In this episode, Robert speaks about Malicious User Stories and DevOps with Apollo Clark. He discusses how to properly handle user stories in a world being taken over by DevOps.You can find Apollo on Twitter @apolloclarkFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Megan Roddie -- Neurodiversity in Security

Megan Roddie joins Robert at the SOURCE Conference in Boston. She talks about how neurodiverse people can truly help an organization.You can find her on Twitter @megan_roddieFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Chase Schultz -- AppSec and Hardware

Chase Schultz joins to discuss the combination of AppSec and hardware. He also dives into how the Meltdown and Spectre attacks worked.You can find Chase on Twitter @f47h3r_B0FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

John Melton -- #OWASP AppSensor

John Melton joins to discuss the #OWASP AppSensor project. He talks about how AppSensor works and how it can be used in your application.You can find John on Twitter @_jtmeltonFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

David Habusha -- Third Party Software is not a Cathedral, Its a Bazaar

David Habusha joins to discuss the OWASP Top 10 A9: Using components with known vulnerabilities. He also dives into the Software Composition Analysis (SCA) market.You can find David on Twitter @davidhabushaFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Steve Springett -- Dependency Check and Dependency Track

Steve Springett joins the show to talk about Dependency Check and Dependency Track. He also discusses how they can help prevent you from using components with known vulnerabilities.You can find Steve on Twitter @stevespringettFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Steven Wierckx -- The #OWASP Threat Modeling Project

Steven Wierckx joins Robert and Chris this week to talk about the #OWASP Threat Modeling project that hes involved in.You can find Steven on Twitter @ihackforfunhttps://open-security-summit.org/FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jim Manico -- The #OWASP Cheat Sheet Project

Jim Manico joins us to discuss some of the changes with the OWASP Cheat Sheets and their plans for that project's future. Jim also talks about how they are looking for experts to create or update some of the Cheat Sheets. You can find Jim on Twitter @manicodeFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Neil Smithline -- OWASP Top 10 #10: Logging

Neil Smithline joins this week to discuss one of the new items on the OWASP Top 10 List, Insufficient Logging and Monitoring.You can find Neil on Twitter @neilsmithineFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jim Routh -- Selling #AppSec Up The Chain

Jim Routh joins the podcast to discuss selling #AppSec up the chain. Jim has built five successful software security programs in his career and serves as a CISO now. Jim shares his real-world experience with successfully selling #AppSec to senior management (as well as many other pieces of wisdom for running an AppSec program).You can find Jim on Twitter @jmrouth01FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Chris and Robert -- #AppSec Recommendations

Chris and Robert go over a plethora of recommendations they have accumulated over their years of experience in the industry.Chriss recommendations1. Book: Agile Application Security: Enabling Security in a Continuous Delivery Pipelineby Laura Bell (Author), Michael Brunton-Spall (Author), Rich Smith (Author), Jim Bird (Author)https://amzn.com/14919388462. Website: Iron GeekAdrian Crenshaw records many major, non-commercial security conferences and posts the talks to Youtubehttp://www.irongeek.com/3. Book: The DevOps Handbook: How to Create World-Class Agility, Reliability, and Security in Technology Organizationsby Gene Kim (Author), Patrick Debois (Author), John Willis (Author), Jez Humble (Author)https://amzn.com/19427880024. News Source: The RegisterNews site, but has great sources and a bit of...

Magen Wu -- Hustle and Flow: Dealing With Burnout in Security

Magen Wu works through the topic of burnout and mental health in security. She gives examples of handling this and recognizing if people around you are burning out.You can find her on Twitter @infosec_tottieAdditional information on this topic:Jack Daniel often speaks on this topic of burnoutYoutube: The Causes of and Solutions for Security BurnoutYoutube: Infosec Survival Skills: Being Productive, Coping with Stress, & Preventing BurnoutArticle: Becoming jaded with Security BSides Jack DanielFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Katy Anton -- OWASP Top 10 #4 XXE

Katy Anton joins this week to discuss number four on the OWASP Top 10. She dives into what XXE is, how to deal with it, and other new items on the OWASP Top 10 2017.You can find Katy on Twitter @KatyAntonFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pete Chestna -- SAST, DAST, and IAST. Oh My!

Pete Chestna is an advocate for SAST, DAST, and IAST tools and a passionate #AppSec enthusiast. Pete shared A moving quote during this episode: "an #AppSec program is the byproduct of building secure developers. #TruthPete describes the differences between SAST, DAST, IAST, and RASP. The struggles developers encounter using new tools, false positives and how to reduce them, and advice for building an #AppSec program from scratch versus adding tools to a mature program.You can find Pete on Twitter @PeteChestna.Additional information on this topic:TechBeacon learning article for more details on the differences between AppSec testing toolsSAST, DAST, IAST, and RASP:...

Irene Michlin -- We Are Not Making It Worse

Irene Michlin operates at the intersection of security and agility. She teaches about incremental threat modeling and how to make threat modeling when living in an Agile or DevOps world.Irene ends the discussion by saying that her goal when working with a team on threat modeling is that they all conclude, We are not making it worse.You can find Irene on Twitter @IreneMichlin, and check out Irenes talk on Incremental Threat Modeling last year at AppSec EU.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Bill Sempf -- Insecure Deserialization

Bill Sempf joins to talk about insecure deserialization. We do a deep dive and contextual review of the generalities of deserialization and the specifics of how it applies to .NET. Bill begins his journey to understand these vulnerabilities and provides some hints and tips for looking for them in your code.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Chris and Robert -- Security Champions

Security champions are the hands and feet of any well-equipped product security team. Robert and Chris introduce security champions, where to find them, why you need them, and how to set up a beginning champion program from scratch.Here are a few other resources that weve written about Security Champions:Do you have Security Champions in your company?Information security needs community: 6 ways to build up your teamsFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Kevin Greene -- Shifting left

Robert and Chris interview Kevin Greene from Mitre. We discuss an article Kevin wrote about shifting left and exploring codifying intuitions and new projects at Mitre that will bolster the knowledge of your developers and testers. Kevin brings up the need for accurate results from the SAST and DAST tools on the market. He brings an exciting perspective, focusing on research and development at DHS.Kevins article on Dark ReadingCAWEATT&CKFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Conclusion: OWASP is for everyone

This is the conclusion of Season 02 for the AppSec PodCast. This episode focuses on all the OWASP goodness weve experienced this year. Youll hear our favorite clips and explanations from a season full of OWASP.With the publication of this episode, season 02 is a wrap, and on to season 03, which will roll out in March.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Brian Andrzejewski -- Containers Again

This is the final interview from the #AppSecUSA Conference in Orlando, and Brian Andrzejewski joins Chris and Robert.He talks about containers, their usage within #AppSec, and orchestrations.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Tin Zaw -- ModSecurity and #AppSec

Tin Zaw, an advocate for ModSecurity, joins Robert and Chris.He dives into its background, the use of rules, and the many advantages.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Aditya Gupta -- The Exploitation of IoT

Aditya Gupta joins Robert and Chris.They speak with him about the many facets of IoT and some of its effects on pen testing, training, and mobile application security.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jim Manico and Katy Anton -- The Future of the OWASP Proactive Controls

Chris and Robert talk to Jim Manico and Katy Anton about the OWASP Proactive Controls project.We have discussed this before, and they are looking for feedback on the upcoming update.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10

We talk about the future of the OWASP Top 10. We do this by meeting the new project leadership team, understanding the process for how they do governance now and into the future, and how they deal with provided feedback. We look behind the curtain at how they make decisions and use the data and feedback provided.Side note, at the AppSec USA closing, the OWASP T10 leaders did announce that A7 and A10 from the OWASP Top 10 RC1 have been removed.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Robert Hurlbut -- Threat Modeling

On this week's episode of the #AppSec Podcast, Chris and Robert are at #AppSecUSA.We hear a conference talk done by Robert on the topic of Threat Modeling. He goes more in-depth than ever before on the show.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Chris and Robert -- Passwords, Identity, and #AppSec

Robert and Chris talk about Passwords, something we all are familiar with.They dive into specifics with passwords and threats that can occur with them. They also talk about how passwords interact with Identity and AppSec.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Tanya Janca and Nicole Becher -- Hacking APIs and Web Services with DevSlop

Tanya and Nicole join Chris and Robert. They talk about what APIs are, how they are used, and some of the threats involved with them. They also look at what DevSlop and ZAP are in combination with APIs.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jon Mccoy and Jonathan Marcil -- Agile #AppSec

Robert and Chris speak with Jon Mccoy and Jonathan Marcil about using Agile #AppSec in the Secure Development Lifecycle.They dive deeper into what agile is, how it can be used, some practical applications using security champions, and much more.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jay Beale -- Docker Security and AppSec

A listener asked for a recommendation for a PodCast or Blog post about Docker security. We looked but couldnt find one, so we created one. Robert interviews Jay Beale from Inguardians and asks what docker is, what threats it introduces, and the specific tie-ins with AppSec.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Chris and Robert -- Proactive Controls, AppSec USA, and Gartners MQ on AppSec Testing

Robert and I try a new format for discussing a few topics per episode. We discuss changes with the Proactive Controls, AppSecUSA, and the Gartner Magic Quadrant for Application Security Testing.We mentioned the link to OWASP Proactive Controls to review the draft and suggest updates.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Robert Hurlbut -- Blackhat Security Conference

We talk with Robert about his experiences at the Blackhat Security Conference.He will explain some of the AppSec-focused parts of the conference and more about the Alec Stamos Keynote.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Dave Ferguson -- The OWASP Top 10 Proactive Controls

Dave Ferguson discusses the OWASP Top 10 Proactive Controls in this episode with Chris.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jim Manico -- MORE OWASP!

Were here today with Jim Manico, a project lead with OWASP. We dive deep into some of the projects on his plate.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mike Goodwin -- The OWASP Threat Dragon

In this episode, we speak with Mike Goodwin, the founder of the OWASP Threat Dragon.We dive into what the threat dragon is and how it can work for youYou can find the tool here: https://github.com/mike-goodwin/owasp-threat-dragonFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mark Willis -- I Just Like Static Analysis. Static Analysis is My Favorite

Were back with another episode of The Application Security Podcast.This time, we talked to Mark Willis about the many facets of static analysis and how it affects the DevOps world.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Eric Johnson -- Continuous Integration in .NET

Welcome back to season two of the Application Security Podcast. In this week's episode, we talk to Eric Johnson about static analysis, pen testing, continuous integration, etc.Thanks for listening!Rate us on iTunes and provide a positive comment, please!FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Matt Clapham -- The Technical Debt Ceiling

Our topic today is technical debt and how security plays into it. Chris was at Converge Conference 2017 in Detroit, Michigan (which he says is the best security conference around) and continued the AppSec PodCast series of hallway conversations. Matt Clapham joins Chris. This is Matts second time on the podcast.Rate us on iTunes and provide a positive comment, please!FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Chris and Robert -- Controversy within the OWASP Top 10 RC

On this episode of the application security podcast, Robert and I jump over a wall. Just kidding. This isnt Top Gear.This is our second episode of season two of the #AppSec PodCast. Robert and I talk about the OWASP Top 10 2017 release candidate. We walk through what the OWASP Top 10 is and what some of the controversies surround the changes made for this year.Rate us on iTunes and provide a positive comment, please!FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Brook S.E. Schoenfield -- Security in the Design and Architecture

This episode is an interview Robert and I did with Brook Schoenfield (@BrkSchoenfield) during the RSA Conference 2017.Brook S.E. Schoenfield is a Distinguished Engineer at Intel Security Group. At Intel Security (including the former McAfee), Mr. Schoenfield is the senior technical leader for delivering software products that protect themselves and Intel Securitys customers. He has been a security architecture leader at global technology companies for over 15 years of his 30+ years in high tech. He is a founding member of IEEEs Center For Secure Design.We discuss secure design, architecture, and threat modeling. Brook has been an advocate for security...

Conclusion: The Endof Season 1

Good day, friends. The Application Security PodCast has concluded our first season. With many friends' help, we could record 18 episodes. Weve done something different for this final episode of season 1. Our producer, Daniel Romeo, has collected some of our favorite clips from this season, the things that stood out to us. Enjoy! And we look forward to the release of season 2 in a few months.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant?

Greetings all! We have a treat for you in this episode. The crew joins Robert and me from the Down the Security Rabbit Hole Podcast. This includes Rafal Los (@wh1t3rabbit), James Jardine (@jardinesoftware), and Michael Santarcangelo (@catalyst). This is a unique conversation for me because the AppSec PodCast was born from my first interview with #DtSR. I was featured on DtSR Episode 204 in July 2016 after a friend suggested me to Raf on Twitter. (Thanks, Nigel!) The DtSR episode was entitled On Changing Culture. I had listened to these guys on and off for years and now had the...

Adam Shostack -- Think like an Attacker or Accountant?

On this episode, Robert and I are joined by Adam Shostack (@adamshostack). Adam is a well-known speaker and thought leader in application security. We speak with Adam about how to connect with development teams. This all started about a year ago when Adam tackled the issue of thinking like a hacker and why he wanted people to think differently. We dive deep into this issue, but many other exciting nuggets also fall out in conversation.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jon McCoy -- The Mindset to Reverse Engineer

Today we talk to Jon McCoy (@thejonmccoy), a developer turned security person. Hes been helping developers learn more about security. We talk about reverse engineering malware and .NET security, as well as a bit of security community and the mindset to Reverse Engineer.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Chris Romeo -- AppSec Awareness: A Blue Print for Security Culture Change

We bring you a recorded version of Chriss security conference talk from 2016 for this episode. The talk is AppSec Awareness, A Blue Print for Security Culture Change. He covers The Problem Space, why we need application security, how to create sustainable security culture, and introduces the idea of Application Security Awareness. Chris had the luxury of building such a program while at Cisco and shares his experiences with the community.There are slides available to correspond with this talk. They arent required, but some may want to follow along. Check out https://speakerdeck.com/edgeroute to get a copy.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn:...

Tracy Maleeff -- Natural Paranoia as a Career Path? A Transition to Security

In this episode, Robert and I are joined by Tracy Maleeff. Tracy is an InfoSec enthusiast with an MLIS degree. She has mad research and organizational skills. She co-hosts the PVCSec podcast. You can find Tracy on Twitter @InfoSecSherpa.Tracy is in the midst of a career transition. She began her career in Library Sciences and is moving into Information Security. We discussed the challenges of transition, how to network and connect, a process for transition, and three actionable things for those that want to make a transition. Enjoy!FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Chris Romeo -- Security Community at Any Scale

In this episode, Robert interviews Chris about the security community. Chris talks about his experiences doing security community at a large organization for 5+ years. Robert keeps pushing Chris to make this applicable to small companies as well. Youll hear best practices for building a security community in your org, including monthly training sessions, lunch and learns, and even an internal security conference. Chris also offers the profound statement that everyone eats lunch.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deidre Diamond -- The Soft Skills of AppSec

We are joined by Deidre Diamond, Founder, and CEO @cyber_sn & the Founder of @brain_babe. We discuss employment in the world of application security. We also dive deep into soft skills, exploring why they are foundational in the workforce. Deidre explains the benefits of win-win conversation, how words and everyday language connect, and how to have fun, compassion, love, integrity, and productivity all in one at work.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Tony UcedaVelez -- PASTA: Not Just for Breakfast Anymore

This is our third interview from ISC2 Security Congress. We are joined by Tony UcedaVelez, or TonyUV, founder and CEO of VerSprite a global security consulting firm based in Atlanta, GA. Tony leads the OWASP Atlanta Chapter and BSides Atlanta.This is a deep dive into Tonys experience with threat modeling. We explore the PASTA methodology he created.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL

This is our second interview at ISC2 Security Congress. We are joined by Glenn Leifheit (@gleifhe), an InfoSec and Development Evangelist at Microsoft. Microsoft is the grandparent to almost every secure development lifecycle across the industry.This is an in-depth discussion about how actually to do SDL. Glenn shares some things during this conversation that Ive never heard about the internals of Microsofts SDL process in public. You will take something away from this conversation to apply to your program.Enjoy!FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mike Landeck -- Security Must Meet the Needs of the Business

Mike Landeck joins Robert and me. Mike is a Cyber security evangelist, AppSec junky & Docker Security geek, and can be found on Twitter @MikeLandeck.We interviewed Mike in person at the ISC2 Security Congress event in Orlando, Florida. We discussed his latest talk on breach fatigue, the need to reach outside the echo chamber of security, Twitter as a news source for security, secure coding, and many other things.Please enjoy, and search for something you can apply directly into your day-to-day life!FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Daniel Ramsbrock -- Web Application Pen Testing Part 2

On this two-part episode of the Application Security PodCast, Robert and I speak with Daniel Ramsbrock about Web App Penetration testing. In part two, we focus on the process of pen testing and web app pen testing.I (Chris) connected with Daniel through the RVASec security conference in Richmond, Virginia. Daniel has been in security for over ten years, focusing most of that time on application security. He spent two years as a full-time consultant at Cigital and is now doing independent AppSec consulting through his company, Enigma Technologies. We hope you enjoy it!FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security...

Daniel Ramsbrock -- Web Application Pen Testing Part 1

On this two-part episode of the Application Security PodCast, Robert and I speak with Daniel Ramsbrock about Web App Penetration testing. In part one, we focus on the difference between pen testing and web app pen testing, where pen testing fits your development methodology (waterfall, agile, and DevOps), and why someone should care about it.I (Chris) connected with Daniel through the RVASec security conference in Richmond, Virginia. Daniel has been in security for over ten years, focusing most of that time on application security. He spent two years as a full-time consultant at Cigital and is now doing independent AppSec...

Matt Clapham -- Development Security Maturity

Robert and I are joined today by Matt Clapham. Matt makes products more secure I mean, hey, his Twitter handle is @ProdSec.The topic of this interview is what Matt calls development security maturity. This concept is based on Matts research and his talk at RSA. Matt created a simple process to measure the maturity of development security by looking at five key behaviors. We cover the what and why of development security, the five key behaviors, and scoring and reporting. In conclusion, we discuss how to make the results of an assessment actionable.Matts RSA slides are a great resource to...

Elena Elkina -- Privacy and Data Protection

Welcome to the first of many interviews on the #AppSec Podcast. In this episode, Robert and I interview Elena Elkina (@el0chka) on privacy. We cover privacy, data protection, and customer data protection. This is a quick chat for around 20 minutes. In the future, well dive deeper into the crossroads of security and privacy.Elena is a Senior Global Privacy & Data Protection Management Executive. She has worked with financial and healthcare institutions, software and internet companies, major law firms, and the government sector on both international and domestic levels. She co-founded Women in Security and Privacy, a non-profit organization focusing...

Chris and Robert -- Security in the Methodology

In this episode, we talk about product development methodologies and the impact of security. We explore how to apply security activities to waterfall and Agile and discuss the pros and cons. Weve both had experience with these methodologies and freely share what weve seen work and what weve seen fail. This applies whether you are new to security or have been doing security for decades. If you have anything to add, share your wisdom by catching us @AppSecPodcast on Twitter!FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Chris and Robert -- The Activities of the Secure Development Lifecycle

On this episode of the Application Security PodCast, we continue our journey through the foundations of application security. We explore the activities of the secure development life cycle. We cover requirements, secure design, secure coding, 3rd party SW, static analysis, vulnerability scanning, and others.FOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Chris and Robert -- Introductions and why #AppSec?

In the inaugural episode of the Application Security PodCast, Robert and I introduce ourselves to the audience, explain our journeys into the security world, and answer the burning question, What the heck is application security?The key takeaways from this episode are:Application security is:foundationalrequired by customersa worthy investmenta people issue supported by toolsFOLLOW OUR SOCIAL MEDIA:Twitter: @AppSecPodcastLinkedIn: The Application Security PodcastYouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Critical Thinking - Bug Bounty Podcast

---

Episode 170: Claude Code + Tmux, Websockets, and Other Korea LHE Takeaways

Episode 170: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph their trip to Korea with some quick takeaways from the LHE. Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also...

Episode 169: Attacking OAuth 2.1

Episode 169: In this episode of Critical Thinking - Bug Bounty Podcast gr3pme goes over some of the changes from OAuth 2.0 vs 2.1 and how Hackers can capitalize.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports,...

Episode 168: XSSDoctor - Client-side Path Traversal Research

Episode 168: In this episode of Critical Thinking - Bug Bounty Podcast were getting a visit from the XSS Doctor. Jonathan joins us to go through his Client-side workflow, run labs, and diagnose some bugs live.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private...

Episode 167: Stealing Bugs with Valeriy Shevchenko

Episode 167: In this episode of Critical Thinking - Bug Bounty Podcast we welcome Valeriy Shevchenko to talk about program management, anchor programs, and Theft in Bug Bounty.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You...

Episode 166: Rez0s Top Claude Skill Secrets

Episode 166: In this episode of Critical Thinking - Bug Bounty Podcast we talk about Rez0s Claude Skill Secrets, when AI Generated reports fall apart, and agents vs filters.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports,...

Episode 165: Protobuf Hacking, AI-Powered Bug Hunting, and Self-Improving Claude Workflows

Episode 165: In this episode of Critical Thinking - Bug Bounty Podcast Justin recaps his Zero Trust World experience, before we dive into Permissions issues client-side bugs, New Hardware Hacking Classes, and using AI to hack.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private...

Episode 164: Tommy DeVoss: From Black Hat to Bug Bounty LEGEND

Episode 164: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with Tommy DeVoss to talk about his origin story, Yahoo bugs, and how Tommy first got Justin into Bug BountyFollow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses,...

Episode 163: Best Technical Takeaways from Portswigger Top 10 2025

Episode 163: In this episode of Critical Thinking - Bug Bounty Podcast Its that time of year again! Were looking at the Portswigger Research list of top 10 web hacking techniques of 2025.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools,...

Episode 162: HackerOne Training AI on Bug Bounty Data?

Episode 162: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph sit down with HackerOne Founder & CTO Alex Rice to discuss concerns of Using Hacker Data for AI and decreasing bounties.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private...

Episode 161: Cross-Consumer Attacks & DTMF Tone Exfil

Episode 161: In this episode of Critical Thinking - Bug Bounty Podcast Justin Gives us some quick hits regarding CSRF and Cross Consumer Attacks, and also touches on some breaking questions surrounding HackerOneFollow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools,...

Episode 160: Cloudflare Zero-days & Mail Unsubscribing for XSS

Episode 160: In this episode of Critical Thinking - Bug Bounty Podcast Joseph and Brandyn. Chat through some news, Including a Cloudflare Zero-day, Turning List-Unsubscribe into an SSRF/XSS Gadget, & Magic String Denial of Service in Claude.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to...

Episode 159: Avoiding Downgrades on Google Cloud VRP with Cote and Darby Hopkins

Episode 159: In this episode of Critical Thinking - Bug Bounty Podcast we sit down with the Google Cloud VRP Team to deep-dive policy and reward changes, what the panel process looks like, and how to best configure for success.Follow us on XGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X:====== Ways to Support CTBBPodcast ======Hop on the CTBB DiscordWe also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits,...

Episode 158: 10hr Marathon Hack-Along Recap + $300k Client-side Bugs

Episode 158: In this episode of Critical Thinking - Bug Bounty Podcast we talk about our personal takeaways from the CTBB Charity Hackalong, and then break down some InsertScript POCs, what a $55,000 bug can look like, and if Smart People Ever Say Theyre Smart.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10,...

Episode 157: Crushing Pwn2Own & H1 with Kernel Driver Exploits

Episode 157: In this episode of Critical Thinking - Bug Bounty Podcast were joined by Hypr to talk about hacking Mediatek and his experiences with HackerOne and Pwn2Own Ecosystems.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted...

Episode 156: Chill AMA from bugbounty.forum

Episode 156: In this episode of Critical Thinking - Bug Bounty Podcast we answer some fantastic questions from over at bugbounty.forumFollow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X:https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pme====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!====== Resources...

Episode 155: 2025 Hacker Stats & 2026 Goals

Episode 155: In this episode of Critical Thinking - Bug Bounty Podcast Justin, Joseph, and Brandyn reflect on last year of Bug Bounty, and list their goals and predictions for what 2026 holds.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pme====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts,...

Episode 154: Starting a Pentesting Company on Top of Bug Bounty

Episode 154: In this episode of Critical Thinking - Bug Bounty Podcast Joseph and Brandyn talk through the transition from Bug Bounty hunting to Pentesting. We cover diversifying income streams, the challenges of pricing for Pentests, legal considerations, and what Bug Hunters can bring to the Pentesting worldFollow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pme====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at...

Episode 153: Hacking the Robots of the Future: Hardware, AI, and Bug Bounties with Matt Brown

Episode 153: In this episode of Critical Thinking - Bug Bounty Podcast Matt Brown returns to talk with us about hacking robots, IOT hackbots, and his Zero-to-Hero Hardware Hacking Guide.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pme====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports,...

Episode 152: GeminiJack and Agentic Security with Sasi Levi

Episode 152: In this episode of Critical Thinking - Bug Bounty Podcast were joined by Sasi Levi from Noma Security to talk about AI and Agentic Security. We also talk about ForcedLeak, a Google Vertex Bug, and debate if Prompt Injection is a real Vuln.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pme====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and...

Episode 151: Client-side Advanced Topics

Episode 151: In this episode of Critical Thinking - Bug Bounty Podcast were covering Client-side advanced topics. Justin talks Joseph (and us) through Third-Party Cookie Nuances, Iframe Tricks, URL Parsing, and more.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X:https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pme====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug...

Episode 150: ASP.NET MVC Patterns, Popping Oracle Identity, and Esoteric Subdomain Enumeration

Episode 150: In this episode of Critical Thinking - Bug Bounty Podcast we're highlighting some cool news and research, but not before expressing our gratitude to the Hacker community. We are so thankful for you all!Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pme====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses,...

Episode 149: DEFCON Debrief: AI Vulns, Unicode Weirdness, and Wild Vulnerability Chains

Episode 149: In this episode of Critical Thinking - Bug Bounty Podcast The DEFCON videos are up, and Justin and Joseph talk through some of their favorites.Follow us on XGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag...

Episode 148: MCP Hacking Guide

Episode 148: In this episode of Critical Thinking - Bug Bounty Podcast Justin gives us a crash course on Model Context Protocol.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pme====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at...

Episode 147: Stupid Simple Hacking Workflow Tips

Episode 147: In this episode of Critical Thinking - Bug Bounty Podcast we're talking tips and tricks that help us in hacking that we really shouldve learned sooner.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pme====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can...

Episode 146: Hacking Horror Stories

Episode 146: In this episode of Critical Thinking - Bug Bounty Podcast Justin, Joseph, and Brandyn all sit down to celebrate the spooky season by swapping their scariest bug stories. From frightening fails and firings to hacks with chilling and critical consequences. Grab your flashlight and a blanket for this one!Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pme====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do...

Episode 145: Gr3pme's Secret: Bug Bounty Note Taking Methodology

Episode 145: In this episode of Critical Thinking - Bug Bounty Podcast Brandyn lets us in on some of his notetaking tips, including his Templates, Threat Modeling, and ways he uses notes to help with collaboration.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, Rez0, & gr3pme on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pme====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits,...

Episode 144: Googles Top AI Hackers: Busfactor and Monke

Episode 144: In this episode of Critical Thinking - Bug Bounty Podcast Joseph is joined by Vitor Falco and Ciarn Cotter to discuss their success at the recent Mexico LHE, as well as their journey and routines in fulltime hacking. Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get...

Episode 143: New Cohost + Client-Side Gadgets, LHE Meta Instant Global Admin in Entra!

Episode 143: In this episode of Critical Thinking - Bug Bounty Podcast Justin brings Brandyn back to announce him as our newest co-host. We chat about recent LHE experiences, and then break down some news. Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits,...

Episode 142: Gr3pme's Full-Time Hunting Journey Update, Insane AI research, And Some Light News

Episode 142: In this episode of Critical Thinking - Bug Bounty Podcast Rez0 and Gr3pme join forces to discuss Websocket research, Metas $111750 Bug, PROMISQROUTE, and the opportunities afforded by going full time in Bug Bounty.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools,...

Episode 141: Hacking the Pod - Google Docs 0-day & React CreateElement Exploits with Nick Copi (7urb0)

Episode 141: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with Nick Copi to talk about CSPT, React, CSS Injections and how Nick hacked the pod.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You...

Episode 140: Crit Research Lab Update & Client-Side Tricks Galore

Episode 140: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph give an update from The Crit Research Lab, as well as some writeups on postMessage vulnerabilities, Cookie Chaos, and more.Follow us on X at: https://x.com/ctbbpodcastGot any ideas and suggestions? Send us feedback at info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord!Get some hacker swag here!====== This Week in Bug Bounty ======Cross-site request forgeryHackerOne New Milestone ProgramEmail santerra.holler@bugcrowd.com for media opportunities====== Resources ======Exploiting Web Worker XSS with BlobsCritical Research LabRez0's...

Episode 139: James Kettle - Pwning in Prod & How to do Web Security Research

Episode 139: In this episode of Critical Thinking - Bug Bounty Podcast Justin finally sits down with the great James Kettle to talk about HTTP Proxys, metagaming research, avoiding burnout, and why HTTP/1.1 must die!Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools,...

Episode 138: Caido Tools and Workflows

Episode 138: In this episode of Critical Thinking - Bug Bounty Podcast Were talking Caido tools and workflows. Justin gives us a list of some of the Caido tools that have caught his interest, as well as how hes using them.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get...

Episode 137: How We Do AI-Assisted Whitebox Review, New CSPT Gadgets, and Tools from SLCyber

Episode 137: In this episode of Critical Thinking - Bug Bounty Podcast Justin Gardner and Joseph Thacker reunite to talk about AI Hacking Assistants, CSPT and cache deception, and a bunch of tools like ch.at, Slice, Ebka, and more.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private...

Episode 136: Hacking Cluely, AI Prod Sec, and How To Not Get Sued with Jack Cable

Episode 136: In this episode of Critical Thinking - Bug Bounty Podcast, Joseph Thacker sits down with Jack Cable to get the scoop on a significant bug in Cluelys desktop application, as well as the resulting drama. They also talk about Jacks background in government cybersecurity initiatives, and the legal risks faced by security researchers.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We...

Episode 135: Akamai's Ryan Barnett on WAFs, Unicode Confusables, and Triage Stories

Episode 135: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with Ryan Barnett for a deep dive on WAFs. We also recap his Exploiting Unicode Normalization talk from DEFCON, and get his perspective on bug hunting from his time at Akamai. Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10,...

Episode 134: XBOW - AI Hacking Agent and Human in the Loop with Diego Djurado

Episode 134: In this episode of Critical Thinking - Bug Bounty Podcast were joined by Diego Djurado to give us the scoop on XBOW. We cover a little about its architecture and approach to hunting, the challenges with hallucinations, and the future of AI in the BB landscape. Diego also shares some of his own hacking journey and successes in the Ambassador World cup.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways...

Episode 133: Building Hacker Communities - Bug Bounty Village, getDisclosed, and the LHE Squad

Episode 133: In this episode of Critical Thinking - Bug Bounty Podcast were joined by Harley and Ari from H1 to talk some about community management roles within Bug Bounty, as well as discuss the evolution of Bug Bounty Village at DEFCON, and what theyve got in store this year.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs...

Episode 132: Archive Testing Methodology with Mathias Karlsson

Episode 132: In this episode of Critical Thinking - Bug Bounty Podcast, Justin Gardner is joined by Mathias Karlsson to discuss vulnerabilities associated with archives. They talk about his new tool, Archive Alchemist, and explore topics like the significance of Unicode paths, symlinks, and TAR before they end up talking about Charsets again..Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord!You can also find...

Episode 131: SL Cyber Writeups, Bug Bounty Metastrategy, and Orphaned Github Commits

Episode 131: In this episode of Critical Thinking - Bug Bounty Podcast we're covering Christmas in July with several banger articles from Searchlight Cyber, as well as covering things like Raycast for Windows, Third-Person prompting, and touch on the recent McDonalds LeakFollow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers...

Episode 130: Minecraft Hacks to Google Hacking Star - Valentino

Episode 130: In this episode of Critical Thinking - Bug Bounty Podcast Justin is joined by Valentino, who shares his journey from hacking Minecraft to becoming a Google hunter. He talks us through several bugs, including an HTML Sanitizer bypass and .NET deserialization, and highlights the hyper creative approaches he tends to employ.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do...

Episode 129: Is this how Bug Bounty Ends?

Episode 129: In this episode of Critical Thinking - Bug Bounty Podcast we chat about the future of hack bots and human-AI collaboration, the challenges posed by tokenization, and the need for cybersecurity professionals to adapt to the evolving landscape of hacking in the age of AIFollow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10,...

Episode 128: New Research in Blind SSRF and Self-XSS, and How to Architect Source-code Review AI Bots

Episode 128: In this episode of Critical Thinking - Bug Bounty Podcast we talking Blind SSRF and Self-XSS, as well as Reversing massive minified JS with AI and a wild Google Logo Ligature BugFollow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts,...

Episode 127: Drama, PDF as JS Chaos, Bounty Profile Apps, And More

Episode 127: In this episode of Critical Thinking - Bug Bounty Podcast we address some recent bug bounty controversy before jumping into a slew of news itemsFollow us on XShoutout to YTCracker for the awesome intro music!Today's Sponsor: Adobe====== This Week In Bug Bounty ======Hackers Guide to Google dorkingYesWeCaidoNew Dojo ChallengeSmart Contract BB tipsRed Team AAS====== Resources ======DisclosedPDF csp bypassBypassing File Upload Restrictions To Exploit Client-Side Path TraversalOBS WebSocket to RCETime in a bottle (or knapsack)How to Differentiate Yourself as a Bug Bounty HunterDisclosed. Onlinehacked-inEchoLeakPiloting Edge CopilotNewtownerTips for agent promptingFirefox XSS vectorsTweet from Masato KinugawaChrome debug() function

Episode 126: Hacking AI Series: Vulnus ex Machina - Part 3

Episode 126: In this episode of Critical Thinking - Bug Bounty Podcast we wrap up Rez0s AI miniseries Vulnus Ex Machina. Part 3 includes a showcase of AI Vulns that Rez0 himself has found, and how much they paid out.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access...

Episode 125: How to Win Live Hacking Events

Episode 125: In this episode of Critical Thinking - Bug Bounty Podcast Justin shares insights on how to succeed at live hacking events. We cover pre-event preparations, challenges of collaboration, on-site strategies, and the importance of maintaining a healthy mindset throughout the entire process.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 -...

Episode 124: Bug Bounty Lifestyle = Less Hacking Time?

Episode 124: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph cover some news from around the community, hitting on Josephs Anthropic safety testing, Justins guest appearance on For Crying Out Cloud, and several fascinating tweets. Then they have a quick Full-time Bug Bounty check-in.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at...

Episode 123: Hacking AI Series: Vulnus ex Machina - Part 2

Episode 123: In this episode of Critical Thinking - Bug Bounty Podcast were back with part 2 of Rez0s miniseries. Today we talk about mastering Prompt Injection, taxonomy of impact, and both triggering traditional Vulns and exploiting AI-specific features.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private...

Episode 122: We Won Google's AI Hacking Event in Tokyo - Main Takeaways

Episode 122: In this episode of Critical Thinking - Bug Bounty Podcast your boys are MVH winners! First were joined by Zak, to discuss the Google LHE as well as surprising us with a bug of his own! Then, we sit down with Lupin and Monke for a winners roundtable and retrospective of the event.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We...

Episode 121: Slonsers Image Injection 0-day -> ATO & New Caido Collab Plugin

Episode 121: In this episode of Critical Thinking - Bug Bounty Podcast we cover so much news and research that we ran out of room in the description...Follow us on XShoutout to YTCracker for the awesome intro music!====== Links ======Follow Rhynorater and Rez0 on X:====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord!We also have hacker swag!====== This Week in Bug Bounty ======Hacker spotlight: RhynoraterUltra Mobile BB Program - Mobile AppsUltra Mobile BB Program - (Public)John Deere ProgramJD's's BB Program Boosts CybersecurityDojo #41 - Ruby treasure====== Resources ======slonser 0-day in chromeCT Additional useful primitivesHow I made $64k from deleted...

Episode 120: SpaceRaccoon - From Day Zero to Zero Day

Episode 120: In this episode of Critical Thinking - Bug Bounty Podcast Justin Gardner welcomes Eugene to talk (aka fanboy) about his new book, 'From Day Zero to Zero Day.' We walk through what to expect in each chapter, including Binary Analysis, Source and Sink Discovery, and Fuzzing everything.Then we give listeners a special deal on the book.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB...

Episode 119: Abusing Iframes from a client-side hacker

Episode 119: In this episode of Critical Thinking - Bug Bounty Podcast Justin does a mini deep dive into the world of iframes, starting with why theyre significant, their attributes, and how to attack them.CORRECTION: Some of my comments on the latest episode of the pod were woefully inaccurate about the `csp` attribute of an iframe. Def should have read the spec more thoroughly. Please see the #corrections channel in Discord for the deets.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links...

Episode 118: Hacking Happy Hour: 0days on Tap and SQLi Shots

Episode 118: In this episode of Critical Thinking - Bug Bounty Podcast we cover a host of news, including clientside tidbits, Credentialless iframes, prototype pollution, and what constitutes a polyglot in llms.txt.Follow us on XShoutout to YTCracker for the awesome intro music!====== Links ======Follow Rhynorater and Rez0 on X====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!You can also find some hacker swag!====== Resources ======p4fg passed 1 Million!/reports/:id.json - $25K CritHacking Crypto pt1The art of payload obfuscationAnalyzing the Next.js Middleware BypassNahamsec's Merch storellms.txt polyglot prompt injectionReact Router and the Remixed pathPre-Authentication SQL Injection in Halo ITSMPwning Millions...

Episode 117: Hacking AI Series: Vulnus ex Machina - Part 1

Episode 117: In this episode of Critical Thinking - Bug Bounty Podcast Joseph introduces Vulus Ex Machina: A 3-part mini-series on hacking AI applications. In this part, he lays the groundwork and focuses on AI reconnaissance. Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses,...

Episode 116: Auth Bypasses and Google VRP Writeups

Episode 116: In this episode of Critical Thinking - Bug Bounty Podcast Justin gives a quick rundown of Portswiggers SAML Roulette writeup, as well as some Google VRP reports, and a Next.js middleware exploit.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts,...

Episode 115: Mentee to Career Hacker - Mokusou (So Sakaguchi)

Episode 115: In this episode of Critical Thinking - Bug Bounty Podcast Justin and So Sakaguchi sit down to walk through some recent bugs, before having a live mentorship session. They also talk about Reflector, and finish up by doing a bonus podcast segment in Japanese!Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to https://x.com/realytcracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and...

Episode 114: Single Page Application Hacking Playbook

Episode 114: In this episode of Critical Thinking - Bug Bounty Podcast were diving into SPA and how to attack them.We also cover a host of news items, including some bug write-ups, AI updates, and a new tool called Hackadvisor.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access...

Episode 113: Best Technical Takeaways from Portswigger Top 10 2024

Episode 113: In this episode of Critical Thinking - Bug Bounty Podcast were breaking down the Portswigger Top 10 from 2024. Theres some bangers in here!Follow us on X at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on X: ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag!======...

Episode 112: Interview with Ciarn Cotter (MonkeHack) - Critical Lab Researcher and Full-time Hunter

Episode 112: In this episode of Critical Thinking - Bug Bounty Podcast Joseph Thacker is joined by Ciarn Cotter (Monke) to share his bug hunting journey and give us the rundown on some recent client-side and server-side bugs. Then they discuss WebSockets, SaaS security, and cover some AI news including Grok 3, Nuclei -AI Flag, and some articles by Johann Rehberger.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop...

Episode 111: How to Bypass DOMPurify in Bug Bounty with Kevin Mizu

Episode 111: In this episode of Critical Thinking - Bug Bounty Podcast Justin interviews Kevin Mizu to showcase his knowledge regarding DOMPurify and its misconfigurations. We walk through some of Kevins research, highlighting things like Dangerous allow-lists and URI Attributes, DOMPurify hooks, node manipulation, and DOM Clobbering.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and...

Episode 110: Oauth Gadget Correlation and Common Attacks

Episode 110: In this episode of Critical Thinking - Bug Bounty Podcast we hit some quick news items including a DOMPurify 3.2.3 Bypass, O3 mini updates, and a cool postLogger Chrome Extension. Then, we hone in on OAuth vulnerabilities, API keys, and innovative techniques hackers use to exploit these systems.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to https://x.com/realytcracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs...

Episode 109: Creative Recon - Alternative Techniques

Episode 109: In this episode of Critical Thinking - Bug Bounty Podcast we start off with a quick recap of some of the DeepSeek Drama thats been going down, and discuss AI in CAPTCHA and 2FA as well. Then we switch to cover some other news before settling in to talk about Alternative Recon TechniquesFollow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to https://x.com/realytcracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We...

Episode 108: How to Hack Salesforce, ServiceNow, and Other SaaS Products With Aaron Costello

Episode 108: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph bring on Aaron Costello to discuss SaaS security and misconfigurations as a bug class. He also gives some in-depth examples from Salesforce, ServiceNow, and Power Pages.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to https://x.com/realytcracker for the awesome intro music!====== Links ======Follow your hosts on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses,...

Episode 107: Bypassing Cross-Origin Browser Headers

Episode 107: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph are tackling the subject of cross-origin security headers. They also cover some news items including Googles OAuth login flaw, RAINK, and gift card hacking.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to https://x.com/realytcracker for the awesome intro music!====== Links ======Follow your hosts on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools,...

Episode 106: Announcing our new cohost...

Episode 106: In this episode of Critical Thinking - Bug Bounty Podcast we are pleased to announce our new co-host of the podcast: Joseph Thacker Aka Rez0! We discuss Joseph's transition to full-time bug bounty hunting, his goals, and what hes looking forward to bringing to the pod. We also cover some news items including doubleclickjacking, character set attacks, SVG XSS, and more.Follow us on twitter at: @ctbbpodcastFeel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Rez0 on twitter:https://x.com/Rhynoraterhttps://x.com/rez0__------ Ways to Support CTBBPodcast ------Hop on the CTBB...

Episode 105: Best Critical Thinking Moments from 2024

Episode 105: In this episode of Critical Thinking - Bug Bounty Podcast we're back with another Best-of episode recapping some of our top moments of 2024.Follow us on twitter at: @ctbbpodcastSsend us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Rez0 on twitter:https://x.com/Rhynoraterhttps://x.com/rez0__------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.Check out our new SWAG store at https://ctbb.show/swag!Todays Sponsor - ThreatLocker. Check out their...

Episode 104: 2024 Hacker Stats & 2025 Goals

Episode 104: In this episode of Critical Thinking - Bug Bounty Podcast Justin reflects upon the past year and walks through some of the bug bounty goals he had for 2024, and how he feels like he did. Then he sets some goals for 2025, as well as some exciting CT news for the coming year.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Rez0 on X:https://x.com/rhynoraterhttps://x.com/rez0__------ Ways to Support CTBBPodcast ------Hop on the CTBB...

Episode 103: Getting ANSI about Unicode Normalization

Episode 103: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph delve into the vulnerabilities associated with ANSI codes and large language models (LLMs), as well as talk through some new research and the value of micro-blogging in general.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord!We offer Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug...

Episode 102: Building Web Hacking Micro Agents with Jason Haddix

Episode 102: In this episode of Critical Thinking - Bug Bounty Podcast Justin grabs Jason Haddix to help brainstorm the concept of AI micro-agents in hacking, particularly in terms of web fuzzing, WAF bypasses, report writing, and more.They discuss the importance of contextual knowledge, the cost implications, and the strengths of different LLM Models.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at...

Episode 101: CTBB Hijacked: Rez0__ on AI Attack Vectors with Johann Rehberger

Episode 101: In this episode of Critical Thinking - Bug Bounty Podcast weve been hijacked! Rez0 takes control of this episode, and sits down with Johann Rehberger to discuss the intricacies of AI application vulnerabilities. They talk through the importance of understanding system prompts, and various obfuscation techniques used to bypass security measures, the best AI platforms, and the evolving landscape of AI security.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------...

Ep 100 - 8 Fav Bugs of 2024, Farewell Joel, Hello Shift - Cursor of Hacking

Episode 100: In this episode of Critical Thinking - Bug Bounty Podcast we have a mixed bag. We celebrate 100 episodes of Critical Thinking, but also bid farewell to Joel, who will be leaving the show as a co-host, but returning as guest. Then we hear from a bunch of friends about their 'best bug of the year', before capping the episode with the announcement of a new AI tool we've been working on!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro...

Episode 99: Back to the Basics - Web Fundamental to 100k a Year in Bug Bounty

Episode 99: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Roni dissect an old thread of Justin's talking about how best to start bug bounty with the goal of making $100k in the first year.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access...

Episode 98: Team 82 Sharon Brizinov - The Live Hacking Polymath

Episode 98: In this episode of Critical Thinking - Bug Bounty Podcast Justin Gardner sits down with Sharon,to discuss his journey from early iOS development to leading a research team at Claroty. They address the differences between HackerOne and Pwn2Own, and talk through some intricacies of IoT security, and some less common IoT attack surfaces.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord...

Episode 97: Bcrypt Hash Input Truncation & Mobile Device Threat Modeling

Episode 97: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel jump into some cool news items, including a recent Okta Bcrypt vulnerability, insights into crypto bugs, and some intricacies of Android and Chrome security. They also explore the latest research from Portswigger on payload concealment techniques, and the introduction of the Lightyear tool for PHP exploits.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support...

Episode 96: Cookies & Caching with MatanBer

Episode 96: In this episode of Critical Thinking - Bug Bounty Podcast were back with Matanber to hit some stuff we ran out of time on last episode. We talk about advanced cookie parsing techniques and exploitation methods, Safari's unique behaviors regarding cookie handling and debugging methods, and some of the writeups from the HeroCTF v6.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB...

Episode 95: Attacking Chrome Extensions with MatanBer - Big Impact on the Client-Side

Episode 95: In this episode of Critical Thinking - Bug Bounty Podcast In this episode, Justin is joined by MatanBer to delve into the intricacies of browser extensions. We talk about the structure and threat models, and cover things like service workers, extension pages, and isolated worlds.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25,...

Episode 94: Zendesk Fiasco & the CTBB Naughty List

Episode 94: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel give their perspectives on the recent Zendesk fiasco and the ethical considerations surrounding it. They also highlight the launch of AuthzAI and some research from Ophion SecurityFollow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium...

Episode 93: A Chat with Dr. Bouman - Life as a Hacker and a Doctor

Episode 93: In this episode of Critical Thinking - Bug Bounty Podcast were joined by Dr. Jonathan Bouman to discuss his unique journey as both a Hacker and a Healthcare Professional. We talk through how he balances his dual careers, some ethical considerations of hacking in the context of healthcare, and highlight some experiences hes had with Amazon's bug bounty program.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Find the Hackernotes: https://blog.criticalthinkingpodcast.io/Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------...

Episode 92 - SAML XPath Confusion, Chinese DNS Poisoning, and AI Powered 403 Bypasser

Episode 92: In this episode of Critical Thinking - Bug Bounty Podcast In this episode Justin and Joel tackle a host of new research and write-ups, including Ruby SAML, 0-Click exploits in MediaTek Wi-Fi, and Vulnerabilities caused by The Great FirewallFollow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Find the Hackernotes: https://blog.criticalthinkingpodcast.io/Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5...

Episode 91: Zero to LHE in 9 Months (feat gr3pme)

Episode 91: In this episode of Critical Thinking - Bug Bounty Podcast Justin Gardner sits down with Critical Thinkings own HackerNotes writer Brandyn Murtagh (gr3pme) to talk about his journey with Bug Bounty. We cover mentorship, networking and LHEs, ecosystem hacking, emotional regulation, and the need for self-care. Then we wrap up with some fun bugs.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Find the Hackernotes: https://blog.criticalthinkingpodcast.io/Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop...

Episode 90: 5k Clickjacking, Encryption Oracles, and Cursor for PoCs

Episode 90: In this episode of Critical Thinking - Bug Bounty Podcast Joel and Justin recap some of their recent hacking ups and downs and have a lively chat about Cursor. Then they cover some some research about SQL Injections, Clickjacking in Google Docs, and how to steal your Telegram account in 10 seconds.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Find the Hackernotes: https://blog.criticalthinkingpodcast.io/Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the...

Episode 89: The Untapped Bug Bounty Landscape of IoT w/ Matt Brown

Episode 89: In this episode of Critical Thinking - Bug Bounty Podcast Were joined live by Matt Brown to talk about his journey with hacking in the IoT. We cover the specializations and challenges in hardware hacking, and Matts personal Methodology. Then we switch over to touch on BGA Reballing, Certificate Pinning and Validation, and some of his own bug stories.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Find the Hackernotes: https://blog.criticalthinkingpodcast.io/Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------...

Episode 88: News, Tools, and Writeups

Episode 88: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel tackle a whole slate of new research including a new cheat sheet for URL validation bypass from Portswigger, the introduction of Sanic DNS as a high-speed DNS resolver, xsstools, and the Dockerization of Orange Confusion Attacks. Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Find the Hackernotes: https://blog.criticalthinkingpodcast.io/ Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB...

Episode 87: 'Hacker Wife' Mariah Gardner on Bug Bounty mentality and relationships

Episode 87: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with none other than his wife Mariah to talk about Bug Bounty from the perspective of a Significant Other. They share how theyve traversed travel and Live Hacking Events, household chores, hobbies, goals, rewards, as well as how best to encourage and support the hacker/non-hacker in your life.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Find the Hackernotes: https://blog.criticalthinkingpodcast.io/Follow your hosts Rhynorater & Teknogeek...

Episode 86: The X-Correlation between Frans & RCE - Research Drop

Episode 86: In this episode of Critical Thinking - Bug Bounty Podcast Frans blows Justins mind with a sneak peak of his new presentation. Note: This is a little different from our normal episode, and video is recommended. So head over to ctbb.show/yt if you feel like youre missing something.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Find the Hackernotes: https://blog.criticalthinkingpodcast.io/Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We...

Episode 85: Practical Applications of DEFCON 32 Web Research

Episode 85: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel talk through some of the research coming out of DEFCON, mainly from the PortSwigger team. Web timing attacks, cache exploitation, and exploits related to email protocols are all featured. Plus we also talk some fun Apache hacks from Orange TsaiFollow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Find the Hackernotes: https://blog.criticalthinkingpodcast.io/Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on...

Episode 84: 0xLupin & Takeaways from Google's Las Vegas BugSwat

Episode 84: In this episode of Critical Thinking - Bug Bounty Podcast, Justin is joined by Roni Carta (@0xLupin) to discuss their MVH win at the recent Google LHE, and share some technical observations they had with the target and the event.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Find the Hackernotes: https://blog.criticalthinkingpodcast.io/Follow your hosts Rhynorater & Teknogeek on twitter:------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and...

Episode 83: Brainstorming Proxy Plugins

Episode 83: In this episode of Critical Thinking - Bug Bounty Podcast Joel and Justin are brainstorming new features and improvements for Caido, such as the implementation of a 403 bypassing workflow, a text expander, Tracing Cookies, and more.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access...

Episode 82: Part-Time Bug Bounty

Episode 82: In this episode of Critical Thinking - Bug Bounty Podcast Joel Margolis discusses strategies and tips for part-time bug bounty hunting. He covers things like finding (and enforcing) balance, picking programs and goals, and streamlining your process to optimize productivity.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium...

Episode 81: Crushing Client-Side on Any Scope with MatanBer

Episode 81: In this episode of Critical Thinking - Bug Bounty Podcast Justin is joined by MatanBer to go over some recent bug reports, as well as share some tips and tricks on client-side hacking and using DevTools effectively.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access...

Episode 80: Pwn2Own VS H1 Live Hacking Event (feat SinSinology)

Episode 80: In this episode of Critical Thinking - Bug Bounty Podcast Justin is joined by Sina Kheirkhah to talk about the start of his hacking journey and explore the differences between the Pwn2Own and HackerOne EventsFollow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private...

Episode 79: The State of CSS Injection - Leaking Text Nodes & HTML Attributes

Episode 79: In this episode of Critical Thinking - Bug Bounty Podcast we deepdive CSS injection, and explore topics like sequential import chaining, font ligatures, and attribute exfiltration.Follow us on twitter at: @ctbbpodcastSend us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.Resources:SpaceRaccoon's Universal Code Execution ExtensionsEscalating Client Side Path TraversalFull-time Bug Bounty BlueprintSequential...

Episode 78: Less Writing, More Hacking - Reporting Efficiency Techniques

Episode 78: In this episode of Critical Thinking - Bug Bounty Podcast were talking about writing reports. We share some tips that weve learned, and discuss ways that AI can (and cant) help with that process. We also talk about the benefit of using tools like Fabric, Loom, and ShareX.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord...

Episode 77: Bug Bounty Mental - Practical Tips for Staying Sharp & Motivated

Episode 77: In this episode of Critical Thinking - Bug Bounty Podcast Joel and Justin discuss some fresh writeups including some MongoDB injections, ORMs, and exploits in Kakao and iOS before pivoting into a conversation about staying motivated and avoiding burnout while hunting.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 -...

Episode 76: Match & Replace - HTTP Proxies' Most Underrated Feature

Episode 76: In this episode of Critical Thinking - Bug Bounty Podcast were talking about Match and Replace and the often overlooked use cases for it, like bypassing paywalls, modifying host headers, and storing payloads. We also talk about the HackerOne Ambassador World Cup and the issues with dupe submissions, and go through some write-ups.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord...

Episode 75: *Rerun* of The OG Bug Bounty King - Frans Rosen

Episode 75: In this episode of Critical Thinking - Bug Bounty Podcast, Justin and Joel are sick, So instead of a new full episode, we're going back 30 episodes to review.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!Today's Guest: https://twitter.com/fransrosen DetectifyDiscovering s3 subdomain takeovershttps://labs.detectify.com/writeups/hostile-subdomain-takeover-using-heroku-github-desk-more/bucket-disclose.shhttps://gist.github.com/fransr/a155e5bd7ab11c93923ec8ce788e3368A deep dive into AWS S3 access controlsAttacking Modern Web TechnologiesLive Hacking like a MVHAccount hijacking using...

Episode 74: Supply Chain Attack Primer - Popping RCE Without an HTTP Request (feat 0xLupin)

Episode 74: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with Roni "Lupin" Carta for a deep dive into supply chain attacks and dependency confusion. We explore the supply chain attacks, the ethical considerations surrounding maintainers and hosting packages on public registries, and chat about the vision and uses of his new tool Depi.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop...

Episode 73: Sandboxed IFrames and WAF Bypasses

Episode 73: In this episode of Critical Thinking - Bug Bounty Podcast we give a brief recap of Nahamcon and then touch on some topics like WAF bypass tools, sandboxed iframes, and programs redacting your reports.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses,...

Episode 72: Research TLDRs & Smuggling Payloads in Well Known Data Types

Episode 72: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel discuss some hot research from the past couple months. This includes ways to smuggle payloads in phone numbers and IPv6 Addresses, the NextJS SSRF, the PDF.JS PoC drop, and a GitHub Enterprise Indirect Method Information bug. Also, we have an attack vector featured from Monke!Follow us on twitter at: @ctbbpodcastShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and...

Episode 71: More VDP Chats & AI Bias Bounty Strats with Keith Hoodlet

Episode 71: In this episode of Critical Thinking - Bug Bounty Podcast Keith Hoodlet joins us to weigh in on the VDP Debate. He shares some of his insights on when VDPs are appropriate in a company's security posture, and the challenges of securing large organizations. Then we switch gears and talk about AI bias bounties, where Keith explains the approach he takes to identify bias in chatbots and highlights the importance of understanding human biases and heuristics to better hack AI.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback...

Episode 70: NahamCon and CSP Bypasses Everywhere

Episode 70: In this episode of Critical Thinking - Bug Bounty Podcast were once again joined by Ben Sadeghipour to talk about some Nahamcon news, as well as discuss a couple other LHEs taking place. Then they cover CI/CD and drop some cool CSP Bypasses.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and...

Episode 69: Johan Carlsson - 3 Month Check-in on Full-time Bug Bounty.

Episode 69: In this episode of Critical Thinking - Bug Bounty Podcast were joined by Johan Carlsson to hear about some updates on his bug hunting journey. We deep-dive a CSP bypass he found in GitHub, a critical he found in GitLab's pipeline, and also talk through his approach to using script gadgets and adapting to highly CSP'd environments. Then we talk about his transition to full-time bug hunting, including the goals hes set, the successes and challenges, and his current focus on specific bug types like ReDoS and OAuth, and the serendipitous nature of bug hunting.Follow us on twitter...

Episode 68: 0-days & HTMX-SS with Mathias

Episode 68: In this episode of Critical Thinking - Bug Bounty Podcast Mathias is back with some fresh HTMX research, including CSP bypass using HTMX triggers, converting client-side response header injection to XSS, bypassing HTMX disable, and the challenges of using HTMX in larger applications and the potential performance trade-offs. We also talk about the results of his recent CTF Challenge, and explore some more facets of CDN-CGI functionality.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts...

Episode 67: VDPs & Accidental Program VS Hacker Debate Part 2

Episode 67: In this episode of Critical Thinking - Bug Bounty Podcast we deepdive on the topic of Vulnerability Disclosure Programs (VDPs) and whether they are beneficial or not. We also touch on the topic of leaderboard accuracy, and continue the Program VS Hacker debate regarding allocating funds for bounties.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord...

Episode 66: CDN-CGI Research, Intent To Ship, and Louis Vuitton

Episode 66: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel discuss the recent YesWeHack Louis Vuitton LHE, the importance of failure as growth in bug bounty, and Justin shares his research on CDN CGI.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterProject Discovery Conference: https://nux.gg/hss24------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium...

Episode 65: Motivation and Methodology with Sam Curry (Zlz)

Episode 65: In this episode of Critical Thinking - Bug Bounty Podcast we sit down with Sam Curry to discuss the ethical considerations and effectiveness of hacking, the importance of good intent, and the enjoyment Sam derives from pushing the boundaries to find bugs. He shares stories of his experiences, including hacking Tesla, online casinos,Starbucks, his own is ISP router, and even getting detained at the airport.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater &...

Episode 64: .NET Remoting, CDN Attack Surface, and Recon vs Main App

Episode 64: In this episode of Critical Thinking - Bug Bounty Podcast we talk about Justin and Joel delve into .NET remoting and how it can be exploited, a recent bypass in the Dom Purify library and some interesting functionality in the Cloudflare CDN-CGI endpoint. They also touch on the importance of collaboration and knowledge sharing, JavaScript Deobfuscation, the value of impactful POCs, hiding XSS payloads with URL path updates.Follow us on twitter at: @ctbbpodcastsend us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast...

Episode 63: JHaddix Returns

Episode 63: In this episode of Critical Thinking - Bug Bounty Podcast we welcome back Jason Haddix (From Episode 12) to talk about some updates to his The Bug Hunter's Methodology, as well as his own personal life and hacking journey. We talk about the start of his new company, and then venture into topics such as using threat intelligence and buying credentials from the dark web, recon techniques, and ways to integrate AI into your workflow (or target list).Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout...

Episode 62: Frontend Language Oddities

Episode 62: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel are back with some additional research resources that didnt make the Portswigger Top-Ten, but that are worth looking at.Follow us on twitter at: @ctbbpodcastFeel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:------ Ways to Support CTBBPodcast ------Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.Sign up for...

Episode 61: A Hacker on Wall Street - JR0ch17

Episode 61: In this episode of Critical Thinking - Bug Bounty Podcast Justin is joined by Jasmin Landry to share some stories about startup security, bug bounty, and the challenges of balancing both. He also shares his methodology for discovering OAuth-related bugs, highlights some differences between structured learning and self-teaching, and then walks us through a couple arbitrary ATOs and SSTI to RCE bugs hes found lately.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater &...

Episode 60: Our Take on PortSwigger's Top 10 Web Hacking Techniques of 2023

Episode 60: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel review the Portswigger Research list of top 10 web hacking techniques of 2023.Follow us on twitter at: @ctbbpodcastSend us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:------ Ways to Support CTBBPodcast ------Hop on the CTBB DiscordWe also do Discord subs at $25, $10, $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc. Resources:Top 10 web hacking techniques of 20231: Smashing the state machine8: From Akamai to...

Episode 59: Bug Bounty Gadget Hunting & Hacker's Intuition

Episode 59: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel discuss the concept of gadgets and how they can be used to escalate the impact of vulnerabilities. We talk through things like HTML injection, image injection, CRLF injection, web cache deception, leaking window location, self-stored XSS, and much more.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:------ Ways to Support CTBBPodcast ------Sign up for Caido using the...

Episode 58: Youssef Sammouda - Client-Side & ATO War Stories

Episode 58: In this episode of Critical Thinking - Bug Bounty Podcast we finally sit down with Youssef Samouda and grill him on his various techniques for finding and exploiting client-side bugs and postMessage vulnerabilities. He shares some crazy stories about race conditions, exploiting hash change events, and leveraging scroll to text fragments. Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Sign up for Caido using the referral...

Episode 57: Technical breakdown from Miami Hacking Event - H1-305

Episode 57: In this episode of Critical Thinking - Bug Bounty Podcast, Justin and Joel are live from Miami, and recap their experience and share takeaways from the live hacking event. They highlight the importance of paying attention to client-side routing and the growing bug class of client-side path traversal. They also discuss the challenges of knowing when to cut your losses and the value of tracking time and setting goals. Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow...

Episode 56: Using Data Science to win Bug Bounty - Mayonaise (aka Jon Colston)

Episode 56: Using Data Science to win Bug Bounty - Mayonaise (aka Jon Colston)Episode 56: In this episode of Critical Thinking - Bug Bounty Podcast, Justin sits down with Jon Colston to discuss how his background in digital marketing and data science has influenced his hunting methodology. We dive into subjects like data sources, automation, working backwards from vulnerabilities, applying conversion funnels to bug bounty, and the mayonaise signature 'Mother of All Bugs' Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------...

Episode 55: Popping WordPress Plugins - Methodology Braindump

Episode 55: In this episode of Critical Thinking - Bug Bounty Podcast, Justin is joined by Wordpress Security Researcher Ram Gall to discuss both functionality and vulnerabilities within Wordpress Plugins.Follow us on twitterSend us any feedback here:Shoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:------ Ways to Support CTBBPodcast ------WordFence - Sign up as a researcher! https://ctbb.show/wf---Sign up for Caido using the referral code CTBBPODCAST for a 10% discount.Hop on the CTBB DiscordWe also do Discord subs at $25, $10, $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts,...

Episode 54: White Box Formulas - Vulnerable Coding Patterns

Episode 54: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel are back with news items and new projects. Joel shares about his personal scraping project to gather data on bug bounty programs and distribution Next, they announce the launch of HackerNotes, a podcast companion that will summarize the main technical points of each episode. They also discuss a recent GitLab CVE and an invisible prompt injection, before diving into a discussion (or debate) about vulnerable code patterns.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback...

Episode 53: 500k/yr as Full-Time Bug Hunter & Content Creator - Nahamsec

Episode 53: In this episode of Critical Thinking - Bug Bounty Podcast,were joined by none other than NahamSec. We start by discusses the challenges he faced on his journey in bug bounty hunting and content creation, including personal struggles and the pressure of success.We also talk about finding balance and managing mental energy, going the extra mile, and the importance of planning and setting goals for yourself before he walks us through some Blind XSS techniques.Follow us on twitter at: @ctbbpodcastFeel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts...

Episode 52: Best Technical Content from Year 1 of CTBB Podcast

Episode 52: In this episode of Critical Thinking - Bug Bounty Podcast we're going back and highlighting some of the best technical moments from the past year! Hope you enjoy this best of 2023 Supercut!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Sign up for Caido using the referral code CTBBPODCAST for a 10% discount.Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25,...

Episode 51: Hacker Stats 2023 & 2024 Goals

Episode 51: In this episode of Critical Thinking - Bug Bounty Podcast, Justin and Joel are back for the last episode of 2023. We discuss some noteworthy news items including a Hacker One Crit, Caido updates, and some Blind CSS. Then we dive into our own personal Hackers Wrapped recap of the year, before laying out some goals for 2024.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast...

Episode 50: Mathias 'Fall in a well' Karlsson - Bug Bounty Prophet

Episode 50: In this episode of Critical Thinking - Bug Bounty Podcast, Justin catches up with hacking master Mathias Karlsson, and talks about burnout, collaboration, and the importance of specialization. Then we dive into the technical details of MXSS and XSLT, character encoding, and give some predictions of what Bug Bounty might look like in the futureFollow us on twitter at: @ctbbpodcastSend us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:------ Ways to Support CTBBPodcast ------Sign up for Caido using the referral code CTBBPODCAST for a 10% discount.Hop...

Episode 49: Getting Live Hacking Event Invites & Bug Bounty Collab with Nagli

Episode 49: In this episode of Critical Thinking - Bug Bounty Podcast, Justin Gardner is once again joined by Nagli to discuss some of their recent hacking discoveries. They talk about finding and exploiting a backup file in an ASP.NET app, discovering vulnerabilities through Swagger files, and debating the vulnerability of a specific undisclosed domain. Then they reflect on 2023s Live Hacking Event circuit, and preview whats to come in 2024s.This episode sponsored by Wordfence! Wordfence recently launched a game-changer of a bug bounty program with ALL WordPress plugins over 50k installs are in-scope. They are currently paying 6.25x their...

Episode 48: MVH, DEFCON Black Badge, Googler - Sam Erb

Episode 48: In this episode, joined by the spectacular Sam Erb, Google Security Engineer and DEFCON Black Badge winner. We talk about the importance of understanding how systems work to find vulnerabilities, and how his engineering background influences his hunting style and methodologies. Then we jump over to his Career Development and his work with Google, and then chat about some of the recent Google Vulnerability Programs.This episode is sponsored by Wordfence! Wordfence recently launched a game-changer of a bug bounty program with ALL WordPress plugins over 50k installs are in-scope. They are currently paying 6.25x their normal bounty amounts,...

Episode 47: CSP Research, Iframe Hopping, and Client-side Shenanigans

Episode 47: In this episode of Critical Thinking - Bug Bounty Podcast, the holidays are fast approaching, and Justin and Joel discuss some of the struggles of getting back into the hacking groove during and after breaks. We also celebrate the newly launched Critical Thinking Discord Community before diving into Iframe Sandwhiches, JS Hoisting, CSP Bypasses, and a host of new tools, techniques, and tangents.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on...

Episode 46: The SAML Ramble

Episode 46: In this episode of Critical Thinking - Bug Bounty Podcast, Justin is deep diving the topic of SAML (Security Assertion Markup Language), and walks through what it is and why it can be intimidating, before going over some key attack vectors to look for. Then he closes out with a commentary on a sample payload, and some HackerOne reports.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support...

Episode 45: The OG Bug Bounty King - Frans Rosen

Episode 45: In this episode of Critical Thinking - Bug Bounty Podcast, we're thrilled to welcome Frans Rosn, an OG bug bounty hunter and co-founder of Detectify. We kick off with Frans sharing his journey bug bounty and security startups, before diving headfirst into a host of his blog posts. We also cover the value of pseudo-code for bug exploitation, understanding developer terminology, the challenges of collaboration and delegating tasks, and balancing hacking with parenting. If you're interested in bug bounty or entrepreneurship, you won't want to miss it!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so...

Episode 44: URL Parsing & Auth Bypass Magic

Episode 44: In this episode of Critical Thinking - Bug Bounty Podcast, the topic is URL structure, and Justin and Joel break down the elements that make up a URL and some common tips and tricks surrounding them which allow for all sorts of bypasses. We also round out the episode with some new tools, ato stories, and some controversial current events in the hacker scene.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek...

Episode 43: Caido - The Up-And-Coming HTTP Proxy

Episode 43: In this episode of Critical Thinking - Bug Bounty Podcast, we're joined by Emile from Caido, who shares his journey into the bug bounty and ethical hacking world. We kick off with a hilarious incident involving Joel, a child on an airplane, and an unfortunate cough. We then dive into the challenges of building an HTTP proxy tool, balancing basic features with nice-to-have features, and the importance of user feedback in shaping the development of Caido, a bug bounty tool.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback...

Episode 42: Renniepak Interview & Intigriti LHE Recap

Episode 42: In this episode of Critical Thinking - Bug Bounty Podcast, we're live from a hacking event in Portugal, and joined by the extremely talented Ren de Sain! He helps us cover a host of topics like NFT, XSS, LHE, and tips for success. We also talk about the correlation between creativity and hacking, shared workspaces, and last but certainly not least, hacker tattoos.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on...

Episode 41: Mini Masterclass: Attack Vector Ideation

Episode 41: In this episode of Critical Thinking - Bug Bounty Podcast, Justin takes a break from his busy travel schedule to walk us through a few of his Attack Vector formulation strategies. Were keeping this one short and sweet, so it can be better used as a reference when looking for new vectors.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Sign up for Caido using the...

Episode 40: Bug Bounty Mentoring

Episode 40: In this episode of Critical Thinking - Bug Bounty Podcast, its all about mentorships! Justin sits down with Kodai and So, two hackers he helped mentor, to discuss what worked and what didnt. We talk about the importance of mentorship, what mentors might look for in a candidate, the challenges of transitioning from being mentored to self-education, and the necessity of continuous learning in this ever-evolving field that is bug bounty. This episode is a treasure trove of insights, and if youre interested in either side of the mentorship coin, you wont want to miss it.Follow us on...

Episode 39: The Art of Architectures

Episode 39: In this episode of Critical Thinking - Bug Bounty Podcast, We're catching up on news, including new override updates from Chrome, GPT-4, SAML presentations, and even a shoutout from Live Overflow! Then we get busy laying the groundwork on a discussion of web architecture. better get started on this one, cause we're going to need a part two!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterCT shoutout from Live Overflowhttps://www.youtube.com/watch?v=3zShGLEqDn8Chrome...

Episode 38: Mobile Hacking Maestro: Sergey Toshin

Episode 38: In this episode of Critical Thinking - Bug Bounty Podcast, we're thrilled to welcome mobile hacking maestro Sergey Toshin (aka @bagipro). We kick off with Sergey sharing his unexpected journey into mobile security, and how he rose to become the number one hacker in both Google Play Security and Samsung Bug Bounty programs. We then delve into the evolving perception of mobile bugs, a myriad of new and existing attack vectors, and discuss Sergey's creation of mobile security company Oversecured. Youre going to want to make time for this one!Follow us on twitter at: @ctbbpodcastWe're new to this...

Episode 37: Tokyo Hacking & Interview with 0xLupin

Episode 37: In this episode of Critical Thinking - Bug Bounty Podcast we're joined by none other than Lupin himself! We recap the Tokyo LHE and the lessons we learned from it before diving into his legendary journey into security research and bug bounty. We also talk collaboration of all kinds: pair hacking, joining a team, and starting a business together. We even touch on some great tools that can collaborate with each other! This was a fun one, and we don't want you to miss it!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free...

Episode 36: Bug Bounty Ethics & CT Exclusive Bug Reports

Episode 36: In this episode of Critical Thinking - Bug Bounty Podcast, Justin and Joel take a break from LHE prep to answer questions about the ethics of bug bounty and share their recent bug finds. We talk Iframes, mobile intercept proxies, open redirects, and that time Justin got shot atFollow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterTimeshifter:https://www.timeshifter.com/Tweet about Google Open Redirecthttps://twitter.com/Rhynorater/status/1697357773690818844 Tweet about XSS Exploitation https://twitter.com/Rhynorater/status/1698059391700701424 Request Minimizerhttps://portswigger.net/bappstore/cc16f37549ff416b990d4312490f5fd1Timestamps:(00:00:00) Introduction(00:02:45) Hacker...

Episode 35: King of Collaboration: Douglas Day

Episode 35: In this episode of Critical Thinking - Bug Bounty Podcast, we're thrilled to welcome Douglas Day, a bug bounty hunter known for his unique methodologies and collaborative spirit. We talk about his approach to finding new endpoints in applications, his ingenious technique of exploiting Intercom widgets, and collaboration preferences and tips at LHEs. We also touch on the struggle of justifying hobbies that don't generate income and the importance of finding enjoyment in the process.We hope you enjoy this episode as much as we did!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free...

Episode 34: Program vs Hacker Debate

Episode 34: In this episode of Critical Thinking - Bug Bounty Podcast, Justin and Joel have both beaten COVID and now square off against each other in a mega-debate representing hackers and program managers respectively. Among the topics included are Disclosures, Dupes, Zero-Day Policy, payouts, budgets, Triage and Retesting. So, if you want blood-pumping, insult-hurling opinion-invalidating debatethen maybe look somewhere else. But if a thought-provoking discussion about bug bounty is more your style, then take a seat and get ready!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout...

Episode 33: The Master of Hacker Show&Tell: Inti De Ceukelaire

Episode 33: In this episode of Critical Thinking - Bug Bounty Podcast, we welcome Inti De Ceukelaire, a seasoned bug hunter known for his creative storytelling and impactful show-and-tell bugsand let us tell you, his stories do not disappoint! From his bug bounty journey to some pretty wild hacks, Inti captivates us as only Inti can. We discuss the potential life-saving impact of bug bounty reports, especially in areas such as transportation and medical devices. We also cover hacker mentality, the benefits of objective-based challenges, and the need for collaboration and alignment within the bug bounty community. Its a mesmerizing...

Episode 32: The Great Write-up Low-down

Episode 32: In this episode of Critical Thinking - Bug Bounty Podcast, Joel caught a nasty bug (no, not that kind) so Justin is flying solo, and catches us up to speed on what's been happening in hacking news.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterSmashing the State articlehttps://portswigger.net/research/smashing-the-state-machine?ps_source=portswiggerres&ps_medium=social&ps_campaign=race-conditionsNagles Algorithmhttps://en.wikipedia.org/wiki/Nagle%27s_algorithm HTTP/2 RFC https://httpwg.org/specs/rfc7540.html Tweet by Alex Chapmanhttps://twitter.com/ajxchapman/status/1691103677920968704?s=20Cookieless Duodrop IIS Auth Bypasshttps://soroush.me/blog/2023/08/cookieless-duodrop-iis-auth-bypass-app-pool-privesc-in-asp-net-framework-cve-2023-36899/ Xss and .Nethttps://blog.isec.pl/all-is-xss-that-comes-to-the-net/Shopify Account Takeoverhttps://ophionsecurity.com/blog/shopify-acount-takeoverShort Name Guesserhttps://github.com/projectmonke/shortnameguesserHacking Points.comhttps://samcurry.net/Points-com/Hacking Starbucks https://samcurry.net/hacking-starbucks/Bug...

Episode 31: Alex Chapman - The Man of Many Crits

Episode 31: In this episode of Critical Thinking - Bug Bounty Podcast, we're thrilled to be joined by Alex Chapman, a seasoned InfoSec hacker and bug bounty hunter. We kick off with Alex sharing his hacking journey, from a guest lecturer that inspired him, to working on internal Red Teams, to his transition to working with HackerOne, and finally as a bug bounty hunter focusing on searching out those few, high impact bugs. We also discuss the power of collaboration, the challenges of balancing hacking with other responsibilities, and the necessity of flexibility and taking breaks in bug bounty work....

Episode 30: Recon Legend Shubs - From Burgers to Bounties

Episode 30: In this episode of Critical Thinking - Bug Bounty Podcast, we're thrilled to be joined by renowned bug bounty hunter Shubs. We kick off with him sharing his journey from burgers to bugs, and how his friendly rivalry with a fellow hacker fueled his passion for reconnaissance, as well as his love of collaboration. We then shift gears to talk about the art of debugging, ethics and economics of bug bounty hunting, the transition to Entrepreneur, and the evolution of Assetnote from a reconnaissance tool to enterprise security software suite. This ones a banger, and we dont want...

Episode 29: Live Episode with Sean Yeoh - Assetnote Engineer

Episode 29: In this episode of Critical Thinking - Bug Bounty Podcast sit down with Assetnote Engineer Sean Yeoh, and pick his brain about what he's learned on his development journey. We talk about the place and importance of message brokers, and which ones we like best, as well as his engineering philosophy regarding bottleneck prevention and the importance of pursuing optimization. Don't miss this episode of terrific technical tips!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your...

Episode 28: Surfin' with CSRFs

Episode 28: In this episode of Critical Thinking - Bug Bounty Podcast, the CSRFs up, dude! We kick off with a debate about whether or not deep link vulns in mobile apps can be considered CSRF. We also talk browser extensions and tools like Hackbar, PwnFox, and JS Weasel, and Justin tries to invent a whole new vuln term. Theres plenty of good stuff here, so what are you waiting for? Jump on in!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro...

Episode 27: Top 7 Esoteric Web Vulnerabilities

Episode 27: In this episode of Critical Thinking - Bug Bounty Podcast, we've switched places and now Joel is home while Justin is on the move. We break down seven esoteric web vulnerabilities, and talk Cookies, Config File Injections, Client-side path traversals and more. We also briefly discuss appliance hacking, new tools, and shout out some new talent in the hacking space. Don't miss this episode full of cool vulns, and experience Justin's vocal decline in real time.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker...

Episode 26: Client-side Quirks & Browser Hacks

In this episode of Critical Thinking - Bug Bounty Podcast, we're back with Joel, fresh (haha) off of back-to-back live hack events in London and Seoul. We compare the different vibes of each LHE, then we dive into the technical thick of it, and talk web browsers, XSS vectors, new tools, CVSS 4.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:______Hunting for NGINX alias traversals in the wildPortSwigger TweetSoroush's Follow-upTweet about magic...

Episode 25: 2xMVH & Multi-million dollar hacker Inhibitor181

Episode 25: In this episode of Critical Thinking - Bug Bounty Podcast we talk to Cosmin (@Inhibitor181), fresh off of winning his 2nd MVH! We chat about the time management and strategy of hacking Multi-Target LHEs, determining when to pivot, and how to find normalcy in bug bounty hunting and Live Hacking Events. We also touch on setting up Vuln Pipelines, creating mental models, and Cosmin's terrifying naming schemes. Don't miss this episode packed with both laughs and valuable insights for beginners and seasoned bug bounty hunters alike.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel...

Episode 24: AI + Hacking with Daniel Miessler and Rez0

Episode 24: In this episode of Critical Thinking - Bug Bounty Podcast, we chat with Daniel Miessler and Rez0 about the emergence and potential of AI in hacking. We cover AI shortcuts and command line tools, AI in code analysis and the use of AI agents, and even brainstorm about the possible opportunities that integrating AI into hacking tools like Caido and Burp might present. Don't miss this episode packed with valuable insights and cutting-edge strategies for both beginners and seasoned bug bounty hunters alike.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send...

Episode 23: Hacker Loadouts

Episode 23: In this episode of Critical Thinking - Bug Bounty Podcast, we delve into a different aspect of hardware - Our personal loadouts. We go through the equipment and gear we use to get our jobs done, and share stories about why we picked what we have. We also touch on live hacking events, the growing acceptance of white hat hacking, and some pretty cool news going on in the hacker world. Don't miss this episode packed with tips and strategies for both beginners and seasoned hackers alike!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so...

Episode 22: Chipping Away at Hardware Hacking

Episode 22: In this episode of Critical Thinking - Bug Bounty Podcast we talk about some basic/intermediate concepts related to Hardware Hacking. Specifically, we dive into extracting data from eMMC chips in order to get our hands on source code for IoT devices. Don't miss this episode packed with valuable insights, tips, and strategies for beginners and seasoned bug bounty hunters alike!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterCheckout NahamCon:https://bit.ly/42vnpMSRiverLoop Security...

Episode 21: Chill Chat with Legendary DoD Hacker Corben Leo

In this episode of Critical Thinking - Bug Bounty Podcast, we chat with Corben Leo about his journey in bug bounty hunting and ethical hacking. We discuss the state of DNS rebinding in 2023, a Twitter thread by Douglas Day (@ArchAngelDDay) on one-hundred bug bounty rules, and our own unique approaches to bug hunting. We also discuss Corben's recon-focused bug hunting methodology and how he developed it. Don't miss this episode filled with valuable tips, insights, and Corben's Boring Mattress Company.Follow us on twitter at: @ctbbpodcastGet on our newsletter for some exclusive content: https://www.criticalthinkingpodcast.io/subscribeWe're new to this podcasting thing, so...

Episode 20: Hacker Brain Hacks - Overcoming Bug Bounty's Mental Tolls

Episode 20: In this episode of Critical Thinking - Bug Bounty Podcast, we dive into the world of "hacker brain hacks'' and overcoming challenges in bug bounty hunting. We discuss custom word lists, the rising popularity of Caido as a potential Burp Suite replacement, and Cloudflared tunnels for hosting POCs. We also tackle the mental aspects of bug bounty hunting, from procrastination to imposter syndrome, and share tips for staying motivated and avoiding burnout. Don't miss this episode packed with valuable insights and advice for both beginners and seasoned bug bounty hunters!Follow us on twitter at: @ctbbpodcastWe're new to this...

Episode 19: Audit Code, Earn Bounties (Part 2) + Zip-Snip, Sitecore, and more!

Episode 19: In this episode of Critical Thinking - Bug Bounty Podcast we further discuss some tips and tricks for finding vulns once youve got source code and some banger tweets/tools that popped up in our feed this week. Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterPart 1:https://open.spotify.com/episode/2pdTaWHSzl9CY7PgRQtvTiNoperators Zip-Snip: https://twitter.com/noperator/status/1658313637189111808https://github.com/noperator/zip-sniphttps://noperator.dev/posts/zip-snip/Insecures SIP Bugs: https://twitter.com/ifsecure/status/1656591469518495745 AssetNotes Sitecore Bugs: https://blog.assetnote.io/2023/05/10/sitecore-round-two/ Fyooers Shadow Clone: https://github.com/fyoorer/ShadowClone

Episode 18: Audit Code, Earn Bounties

Episode 18: In this episode of Critical Thinking - Bug Bounty Podcast, we dive into everything source-code related: how to get source-code and what to do with it once you have. This episode is packed with great examples of successful source code review, tips on how to review code yourself, and the tools you'll need along the way.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterCrossing the KASM:https://www.youtube.com/watch?v=NwMY1umhpggPWNAssistant by Elttam:https://www.elttam.com/blog/pwnassistant/#contentAndre's Git Arbitrary...

Episode 17: LA Live Chat with Five Legendary Hackers

Episode 17: In this episode of Critical Thinking - Bug Bounty Podcast we talk with five legendary hackers about some of their favorite bugs. Live. From LA.Corben Leo Lorben CEO @hacker_Sam ZLZ ZOZL The King Curry @samwcyoFrans The Legend Rosen @fransrosenJonathan Doc Bouman @JonathanBoumanNagliNagliNagli @naglinagliShoutout to Jonathan Boumans Mom!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterFOLLOW OUR LINKEDIN ACCOUNT FOR NAGLI:https://www.linkedin.com/company/ctbbpodcastSam Currys shoutout - Ian Carrols Seats.Aero: https://seats.aero/

Episode 16: The Hacker's Toolkit

Episode 16: In this episode of Critical Thinking - Bug Bounty Podcast we talk about the hackers toolkit. Joel and Justin talk about their VPS setup, go-to hacking tools, most often used Linux commands, and the ways they duct tape all of these together for the big hacks.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on Twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterOur Boi @rez0__ Dropping Some AI Hackz:https://twitter.com/rez0__/status/1648685943539245056?s=20LiveOverflow Prompt Injection:https://www.youtube.com/watch?v=Sv5OLj2nVAQJoels Private Network Solution:https://www.zerotier.com/Stok & Tomnomnom on Vim/Bash:https://www.youtube.com/watch?v=l8iXMgk2nnYLatest GhostScript...

Episode 15: The Israeli Million-Dollar Hacker

Episode 15: In this episode of Critical Thinking - Bug Bounty Podcast we talk with the latest Million-Dollar bug bounty hunter: @naglinagli . He talks about his climb from $1,000 in bounties to $1,000,000, recon tips and tricks, and some bug reports that made the news and landed him the "Best Bug" award at a H1 Live Hacking event.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterFollow Nagli and his new startup...

Episode 14: Mobile Hacking Dynamic Analysis w/ Frida + Random Hacker Stuff

Episode 14: In this episode of Critical Thinking - Bug Bounty Podcast we talk about Dynamic Analysis within Mobile Hacking and a bunch of random hacker stuff. It's a good time. Enjoy the pod.Follow us on Twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on Twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterJoels Alternative to UberTooth One:https://www.amazon.com/Bluetooth-UD100-G03-Exchangeable-Bluesoleil-Microsoft/dp/B0161B5ATMD3monDevs Burp VPS Plug-in:https://github.com/d3mondev/burp-vps-proxyFireProx:https://github.com/ustayready/fireproxJoels Universal SSL De-pinning Frida Script:https://gist.github.com/teknogeek/4dc35fb3801bd7f13e5f0da5b784c725Command-line Fuzzy Finder:https://github.com/junegunn/fzfJustins two article recommendations for using Frida:https://tinyurl.com/5n94d6ryhttps://tinyurl.com/yfy3n5f5Copy screen of physical device:https://tinyurl.com/ymdrscm5Flipper:https://flipperzero.one/BetterCap BLE Module:https://www.bettercap.org/modules/ble/Timestamps:(00:00:00) Intro(00:00:55) Hacker Chats(00:03:27) Podcast...

Episode 13: How to Find a Good BBP + Acropalypse + ZDI

Episode 13: In this episode of Critical Thinking - Bug Bounty Podcast we talk about how to determine if a bug bounty program is good or not from the policy page. We also cover some news including Acropalypse, ZDI's Pwn2Own Competition, Node's Request library's SSRF Bypass, and a new scanning tool by JHaddix. Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterJHaddix AWSScrape Tool:https://twitter.com/Jhaddix/status/1637140192728612865?s=20Acropalypse Links:https://twitter.com/ItsSimonTime/status/1636857478263750656https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse.htmlhttps://twitter.com/David3141593/status/1638222624084951040https://twitter.com/David3141593/status/1638293029059477505SSRF Bypass in NodeJS:https://blog.doyensec.com/2023/03/16/ssrf-remediation-bypass.htmlZDI's Pwn2Own:https://twitter.com/thezdiKuzu7shiki's Awesome Pixiv Report:https://hackerone.com/reports/1861974https://twitter.com/kuzu7shikiSome...

Episode 12: JHaddix on Hacker->Hacker CISO, OG Hacking Techniques, and Crazy Reports

Episode 12: In this episode of Critical Thinking - Bug Bounty Podcast we talk with Jason Haddix about his eclectic hacking techniques, Hacker -> Hacker CISO life, and some crazy vulns he found. This episode is chock full of awesome tips so give it a good listen!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterFollow JHaddix on Twitter:https://twitter.com/jhaddixBuddoBot:https://buddobot.com/BC Hunt:https://github.com/bugcrowd/HUNT/blob/master/README.mdOne List For All:https://github.com/six2dez/OneListForAllAssetNote Wordlists:https://wordlists.assetnote.io/Backslash Powered Scanner:https://portswigger.net/bappstore/9cff8c55432a45808432e26dbb2b41d8Jasons Handy Dandy Acronyms:SSWLR - Sensitive Secrets Were...

Episode 11: CV$$, Web Cache Deception, and SSTI

Episode 11: In this episode of Critical Thinking - Bug Bounty Podcast we talk about CVSS (the good, the bad, and the ugly), Web Cache Deception (an underrated vuln class) and a sick SSTI Joel and Fisher found.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterMDSec Outlook Vuln:https://twitter.com/MDSecLabs/status/1635791863478091778Jub0bs User-Existance Oracle Tweet:https://twitter.com/jub0bs/status/1633786349529513986James Kettle's Tweet About BB ID Header Standardization:https://twitter.com/albinowax/status/163595150679175577615K Snapchat Numeric IDOR:https://hackerone.com/reports/1819832Bug Bounty Reports Explained:https://www.bugbountyexplained.com/CVSS Calculator:https://nvd.nist.gov/vuln-metrics/cvss/v3-calculatorWeb Cache Deception Write-up:https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack.pdf

Episode 10: The Life of a Full-Time Bug Bounty Hunter + BB News + Reports from Mentees

Episode 10: In this episode of Critical Thinking - Bug Bounty Podcast we talk about what its like to be a full-time bug bounty hunter, a tonne of bug bounty news, and some great report summaries from Justins two mentees: Kodai and Soma. Follow us on twitter at: https://twitter.com/ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterHackVertor https://portswigger.net/bappstore/65033cbd2c344fbabe57ac060b5dd100 Not_An_Aardvark (Teddy Katz) Blog: https://blog.teddykatz.com/ Tweets from PortSwigger Research:https://twitter.com/PortSwiggerRes/status/1632742844535324677https://twitter.com/PortSwiggerRes/status/1630221223874445314https://twitter.com/PortSwiggerRes/status/1629131380473970688HackerOne LHE Standards: https://www.hackerone.com/hackerone-community-blog/get-invited-how-live-hacking-event-invites-have-changed Rez0 Bug Bounty Tweet: https://twitter.com/rez0__/status/1553371602770960384?t=NCr_esHcEts9PrcjxIZ5uw&s=19Rojans Github Bug:...

Episode 9: Headless Browser SSRF & RebindMultiA Tool Release + Web3 Bug

Episode 9: In this episode of Critical Thinking - Bug Bounty Podcast we talk about Headless Browser SSRF and drop a tool called RebindMultiA. Joel also walks us through a web3 bug and we cover some bug bounty news from the past week. As always, we drop some bug bounty tips and give you some attack vectors to think about.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Truffle Security End-To-End Encryption Video:https://www.youtube.com/watch?v=BBcZcoIZ1JcHackerOne World Cup:https://www.hackerone.com/hackers/brand-ambassador-programHackerOne World Cup Sign Up Form...

Episode 8: PostMessage Bugs, CSS Injection, and Bug Drops

Episode 8: In this episode of Critical Thinking - Bug Bounty Podcast we drop some critical bugs which leak raw credit card info. We also discuss some CSS Injection & PostMessage related techniques. It's a short one but a good one! Don't miss it!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterCSS Escape Blog Post:https://mathiasbynens.be/notes/css-escapesRez0s blog on ChatGPT:https://rez0.blog/hacking/2023/02/21/hacking-with-chatgpt.htmlAll the ways to get a reference to a frame (shoutout to @wcbowling for the...

Episode 7: PortSwigger Top 10, TruffleSecurity Drama, and More!

Episode 7: In this episode of Critical Thinking - Bug Bounty Podcast we talk about PortSwigger's Top 10 Web Hacking Techniques of 2022 (link below), some drama surrounding TruffleSecurity's XSS Hunter, and, as always, some great bug bounty tips.Sorry if the audio is a little rough around the edges this time, should be better than ever next time.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterPortSwigger's Top 10 Web Hacking Techniques of...

Episode 6: Mobile Hacking Attack Vectors with Teknogeek (Joel Margolis)

Episode 6: In this episode of Critical Thinking - Bug Bounty Podcast we sit down with mobile hacking legend Joel Margolis and get the scoop on his approach to popping bugs on Android.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterJoels HackerOne Android Hacking Introduction:https://t.ly/f87DAndroid Pixel Lock Screen Bypasshttps://t.ly/Q_qqExploiting Deeplink URLs:https://inesmartins.github.io/exploiting-deep-links-in-android-part1/index.htmlJoels get_schemas tool:https://github.com/teknogeek/get_schemasExample AndroidManfest.xml we referenced:https://t.ly/mcN1https://t.ly/ErVVAndroid docs for intent filters:https://developer.android.com/guide/components/intents-filters.htmlAndroid docs for setAllowContentaccess:https://t.ly/hXOZAndroid docs for setAllowFileAccess:https://developer.android.com/reference/android/webkit/WebSettings#setAllowFileAccess(boolean)Add JavaScript Interface to Webview:https://developer.android.com/reference/android/webkit/WebView#addJavascriptInterface(java.lang.Object,%20java.lang.String)Joels SSL Pinning...

Episode 4: H1-407 Event Madness & Takeaways Part 2 w/ Special Guest Spaceraccoon

Episode 4: In this episode of Critical Thinking - Bug Bounty Podcast we have part two of our series on the H1-407 HackerOne Live Hacking Event. This time, we have a special guest SpaceRaccoon (@spaceraccoonsec) talking about techniques and takeaways from the event.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterSpaceraccoons blog:https://spaceraccoon.dev/Spaceraccoons twitter:https://twitter.com/spaceraccoonsecResponder (NTLM Hash harvesting tool):https://github.com/lgandx/ResponderThe malware reversing course Spaceraccoon recommended:https://courses.zero2auto.com/Offensive Security Exploit Development Courses:https://www.offensive-security.com/courses-and-certifications/

Episode 5: AI Security, Hacking WiFi, the New XSS Hunter, and more

Episode 5: In this episode of Critical Thinking - Bug Bounty Podcast we talk about the new XSS Hunter, MD5 collisions and using ChatGPT for security, and much more!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterSave All Resources Chrome Extension: https://chrome.google.com/webstore/detail/save-all-resources/abpdnfjocnmdomablahdcfnoggeeiedb?hl=enCorben's AMA: https://twitter.com/hacker_/status/1620514351521366016Collisions repo: https://github.com/corkami/collisions

Episode 3: H1-407 Event Madness & Takeaways Part 1

Episode 3: In this episode of Critical Thinking - Bug Bounty Podcast we talk about some of the interesting things weve learned from participating in HackerOne's H1-407 Live Hacking event. We cover decompiling binaries in various different languages, Windows URI Handlers, Caido, and SameSite Lax + POST.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterFrans Rosen S3 Bucket Authorization Blog Post: https://labs.detectify.com/2018/08/02/bypassing-exploiting-bucket-upload-policies-signed-urls/Getting code from executables:ILSpyDotPeekJadx-GUIPyinstxtractorUncompyle6Jub0bs SameSite Article:https://jub0bs.com/posts/2021-01-29-great-samesite-confusion/Mgeekys Powershell Script to Enumerate Windows...

Episode 2: Exploit Writing & Automation / Do you need to know how to program to hack?

Episode 2: In this episode of Critical Thinking - Bug Bounty Podcast we talk about exploit writing/automation, some new tools released in the industry (Of-CORS), the age old question of "Do you have to know how to program to hack?", a walk-through of some very impactful bug bounty reports, and some tips and tricks for exploit writing.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterOf-CORS by TruffleSecurityhttps://trufflesecurity.com/blog/of-cors/https://github.com/trufflesecurity/of-corsCyberChefhttps://gchq.github.io/CyberChef/Curl Converterhttps://curlconverter.com/Caidohttps://caido.io/Copy As Python Requestshttps://portswigger.net/bappstore/b324647b6efa4b6a8f346389730df160eMMC Card...

Episode 1: Introductions, Bug Bounty Reports, and BB Tips

Episode 1: In this episode of Critical Thinking - Bug Bounty Podcast, Joel Margolis (aka 0xteknogeek) and Justin Gardner (aka Rhynorater) cover introductions, a couple of cool bug bounty reports, and some really helpful BB Tips.Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynoraterThe report Joel was talking about: https://hackerone.com/reports/1672388

Cyber Distortion Podcast Series

---

S5 - Episode 003 Stuxnet: Zero-Day Cataclysmic Warfare

Cyber Distortion Podcast Hosted by Kevin Pentecost & Jason Popillion In this episode of the Cyber Distortion Podcast, Kevin and Jason discuss one of the most chilling and groundbreaking cyberattacks in history: Stuxnet. What started as a mysterious series of system failures inside Iran's nuclear facilities quickly unraveled into something far more dangerousa precision-engineered digital weapon designed not just to spy, but to destroy. We break down how Stuxnet infiltrated highly secure, air-gapped systems, silently manipulated industrial controls, and physically sabotaged centrifugesall while reporting normal operations back to engineers. This wasn't just malware. It was a turning point. From its...

S5 - Episode 002 Cicada 3301

Cyber Distortion Podcast Hosted by Kevin Pentecost & Jason Popillion In January 2012, a mysterious message appeared on an obscure corner of the internet a simple image posted on 4chan with a chilling promise: "We are looking for highly intelligent individuals." What followed was unlike anything the internet had ever seen. Hidden messages. Impossible riddles. Cryptographic puzzles buried in images, music files, and code. Clues scattered across the globe from obscure websites to real-world posters taped to telephone poles in cities thousands of miles apart. Behind it all was a name that would become internet legend: Cicada 3301. In this...

S5 - Episode 001 The Day that Twitter Died

Cyber Distortion Podcast Hosted by Kevin Pentecost & Jason Popillion On July 15, 2020, the unthinkable happened: dozens of the world's most powerful voices Barack Obama, Elon Musk, Bill Gates, Joe Biden, Apple, Uber, and more suddenly blasted the same message out to millions of followers. A promise that sounded too good to be true because it was. What looked like a generous giveaway turned into one of the most audacious social engineering hacks in tech history all orchestrated not by a foreign syndicate, not by an elite hacker collective but by a 17-year-old from Tampa, Florida. In this episode...

S4 - Episode 014 CYBR.HAK.CON: The L33T DFW Hacker Conference (w/ Michael Farnum & Phillip Wylie)

In this episode, we're diving deep into the evolution of one of the most respected cybersecurity community movements in the country. Michael Farnum, founder of CYBR.SEC.Community and the original force behind HOU.SEC.CON, joins us to talk about the transformation of a beloved Houston-based conference into a multi-city, multi-conference ecosystem designed to empower cybersecurity professionals, enthusiasts, and newcomers alike. With expansion plans already underway, the CYBR.SEC.Community is poised to redefine how regional infosec communities connect, learn, and grow. We're also joined by Phillip Wylie, a well-known ethical hacker, author, and educator, who will be leading CYBR.HAK.CON the Dallas/Fort Worth chapter of...

S4 - Episode 013 The Cyber Crystal Ball: Predictions & Pitfalls (w/ Paul Furtado from Gartner)

In this episode of the Cyber Distortion Podcast, hosts Jason Popillion and Kevin Pentecost sit down with Paul Furtado, Vice President and Analyst at Gartner, for a deep, insightful conversation that cuts through industry noise and gets to the heart of what's shaping cybersecurity and enterprise technology today. Paul brings a dynamic blend of executive leadership and real-world operational expertise, with a career marked by driving bottom-line impact, navigating mergers and acquisitions, optimizing performance, and reshaping strategic technology programs. Known for his visionary leadership, negotiation acumen, and ability to connect strategy with execution, Paul shares the kind of clarity and...

S4 - Episode 012 Zero Trust, Zero Confusion (w/ Rob Allen)

In this eye-opening episode of Cyber Distortion, hosts Kevin Pentecost and Jason Popillion sit down with Rob Allen from ThreatLocker to break down one of the most talked-about and misunderstood concepts in cybersecurity today: Zero Trust. With a deep well of technical expertise and real-world business acumen, Rob brings clarity to the chaos, cutting through the jargon to explain what Zero Trust really means, why it matters, and how organizations of all sizes can adopt it effectively. Whether you're a seasoned security pro or just starting to wrap your head around Zero Trust architecture, this episode gives you the insights...

S4 - Episode 011 Faith, Fire, and Frameworks (w/ Gaelle Koanda)

Today's guest is a true force in cybersecurity, governance, and leadership. She's a global voice for resilience, inclusion, and innovation and her story is as inspiring as it is impactful. In this episode, we were thrilled to be joined by Gaelle Koanda a Cybersecurity and GRC powerhouse, ISACA Board Member, AI Ethics Advocate, Entrepreneur, and Nonprofit Leader. From IT audits to executive boardrooms, Gaelle has carved a path defined by grit, grace, and growth. She's the Founder and President of the very first WiCyS chapters in Francophone Africa, and currently serves as the SheLeadsTech Ambassador for Colorado building bridges across...

S4 - Episode 010 The Making of I AM MACHINE w/Chris Glanden & Len Noe

Description: In this compelling episode of the Cyber Distortion Podcast, hosts Jason sits down with the extraordinary trio behind the groundbreaking documentary I AM MACHINE a deep dive into the life and mission of transhuman white hat hacker, Len Noe. Known for merging biology with embedded technology, Len's journey into transhumanism is as provocative as it is visionary. He uses his cybernetic implants not only to push the boundaries of human capability but also as a powerful tool to demonstrate vulnerabilities in both physical and digital security systems. From real-world pen tests to live hacking demos, Len's ethical hacking blurs...

S4 - Episode 009 Codewaves Rising Surfing Latin Americas Talent Tide (w/ Roger Einstoss)

Description: New Episode Alert Cyber Distortion Podcast Welcome back! In this episode we're diving deep into one of the most pressing challenges in cybersecurity: finding the right talent. Join us for an eye-opening conversation with Roger Einstoss, co-founder of Braintly, a company revolutionizing how organizations source cybersecurity professionals from across Latin America. With decades of experience and a sharp eye for global tech talent, Roger shares insider knowledge on tapping into thriving hubs like Argentina, Brazil, and beyond. We explore how Latin America is rapidly emerging as a hotbed for skilled cybersecurity professionalsand why North American companies are increasingly turning...

S4 - Episode 008 Unleashing Your Inner Hacker (w/ Ted Harrington)

This episode welcomes Ted Harrington, a celebrated ethical hacker, TEDX keynote speaker, and executive partner at Independent Security Evaluators (ISE). With decades of realworld experience hacking everything from iPhones and cars to medical devices, cryptocurrency platforms, and password managers, Ted brings unmatched expertise to our conversation. He's built a reputation for uncovering hidden vulnerabilities, helping clients such as Google, Amazon, Netflix, Microsoft, Disney, and Adobe to fix tens of thousands of security flawsdemonstrating why no system is truly unhackable. In this episode, Ted walks us through his journey from early penetration testing to leading elite security research. We discuss the...

S4 - Episode 007 Reality Distortion is so Freakin' Real! (w/ Winn Schwartau)

In this riveting episode of Cyber Distortion, hosts Kevin Pentecost and Jason Popillion sit down with none other than Winn Schwartau the legendary cybersecurity pioneer and provocateur known for pulling no punches when it comes to the truth. A trailblazer in information warfare and the original mind behind DEFCON Jeopardy, Winn dives deep into the murky waters of misinformation, disinformation, and the global implications of distorted digital realities. From nation-state psyops to corporate manipulation campaigns, we explore how the war over truth is being waged on battlefields both virtual and real. But it wouldn't be Cyber Distortion without a twist....

S4 - Episode 006 LULZSEC Mastermind Unmasked: The Sabu Story (w/ Hector Monsegur)

Welcome back to Cyber Distortion, the show where the shadows of the digital world come into focus. Today's episode dives deep into the mind of someone who once sat at the center of the internet's most notorious hacktivist movements. Our guest is Hector Monsegurbetter known to some as Sabua former leading figure in both Anonymous and LULZSEC, who orchestrated some of the most high-profile cyber-attacks of the early 2010s. From penetrating government networks to being at the heart of a global FBI takedown, Hector's story is part cautionary tale, part cyber-thriller. In this conversation, he shares it allraw, unfiltered, and...

S4 - Episode 005 The Art of the HVCK! (w/ Ryan Williams)

In this electrifying episode, we dive deep into the world of hacking, privacy, and offensive security with Ryan Williams, Editor of HVCK Magazine and Director of Smart Cyber Solutions Pty Ltd. Ryan is more than just a cybersecurity consultanthe's a red team enthusiast, blue team strategist, and relentless innovator in the cyber arena. We explore Ryan's journey from pen tester to publisher, and uncover the vision behind HVCK Magazinean online publication dedicated to all things hacking, from OSINT and threat intelligence to offensive tooling and real-world exploits. Learn about his contributions to the community with projects like Commander, MxFlex, AllTheThings,...

S4 - Episode 004 Human IOT: Sub-Molecular DNA Cybersecurity (w/ Dr. Gregory Carpenter)

In this electrifying episode of the Cyber Distortion Podcast, hosts Kevin Pentecost and Jason Popillion dive into the fascinating crossroads of cybersecurity, health, and molecular science with a very special guest Dr. Gregory Carpenter. Known worldwide for his pioneering research and groundbreaking work at the intersection of biotechnology and cybersecurity, Dr. Carpenter brings a unique and urgent perspective on the growing risks and innovations tied to DNA hacking and cybersecurity at the molecular level. Together, they explore how advances in genetics, bioinformatics, and synthetic biology are creating new vulnerabilities and why protecting health data and even the biological code of...

S4 - Episode 003 Hackers Love You...And Your Overshared Instagram Posts! (w/ Wes Kussmaul)

In this thought-provoking episode of the Cyber Distortion Podcast, we're joined by Wes Kussmaul, a visionary in the realm of secure online identities and the founder of Delphi Internet Services Corporationthe company behind the Kussmaul Encyclopedia, the world's first computerized encyclopedia and one of the earliest forms of hypertext. With over three decades of experience building secure online spaces, Wes brings a unique blend of historical perspective and forward-thinking innovation to the conversation around privacy, authentication, and identity protection. As digital threats evolve, so must our understanding of how we prove who we are online. Wes breaks down the role...

S4 - Episode 002 - Staring Down the Barrel of a Loaded Gun (w/ Ricoh Danielson)

In this gripping episode of the Cyber Distortion Podcast, we sit down with Ricoh Danielson a former U.S. Army Combat Veteran of Iraq and Afghanistan, national security expert, and digital forensics specialist. With a career that bridges the battlefield and the digital frontlines, Ricoh brings a rare and powerful perspective on the evolving threats to our national security and critical infrastructure. From his firsthand experiences in war zones to his current role as a VCISO and digital forensic expert, Ricoh shares stories that are as eye-opening as they are inspiring. We dive into the real-world challenges facing the nation today...

S4 Episode 001 [CTRL-ALT-GEN] Resetting the Generational Tech Divide

Welcome to this episode ofCyber Distortion, where we explore the cutting edge of technology, security, and the future of humanity itself. In this episode, we look into how differing generational outlooksfrom the Silent Generation, to Baby Boomers, Gen X, Millennials, and Gen Zshape the ways teams solve problems and interact within today's corporate landscape. We explore how historical events, technological exposure, and shifting cultural norms have impacted each generation's communication style, work ethic, and appetite for risk. Through candid anecdotes and real-world examples, we uncover the advantages of blending diverse generational perspectives to spark innovation, build more inclusive workplace cultures,...

S3 Episode 014 Navigating the Storm: Mastering Incident Response and Disaster Recovery

In this season finale of the Cyber Distortion Podcast, hosts Kevin Pentecost and Jason Popillion, tackle one of the most critical topics in modern cybersecurityincident response and disaster recovery. When a cyber incident strikes, every second counts. Organizations need to be ready with well-orchestrated plans to respond effectively and recover swiftly. This episode delves deep into the strategies, tools, and best practices that every cybersecurity professional and organization should know to minimize damage and ensure resilience. Kevin and Jason guide listeners through the intricacies of incident response, breaking it down into digestible phases like preparation, detection, containment, eradication, and recovery....

S3 Episode 013 Bridging the Cyber Skills Gap w/Jessie Bolton

Cybersecurity isn't just about technologyit's about people. In this eye-opening episode of the Cyber Distortion Podcast, we're joined by Jessie Bolton, CEO of Bolt Resources and former Vice President of North Texas ISSA, to tackle one of the industry's most pressing challenges: the human side of the cybersecurity skills gap. Jessie brings a wealth of experience from her collaborations with ISC2, WiCyS, NICE, Infosec Institute, and higher education institutions. She's at the forefront of redefining how organizations identify, nurture, and retain talent in an industry facing a critical workforce shortage. From strategies to attract untapped talent to innovative training programs...

S3 Episode 012 Slaying the Surveillance Capitalist Pigs w/Mark Weinstein

Protecting Your Privacy Online with Mark Weinstein In this must-listen episode of the Cyber Distortion Podcast, we dive deep into the critical topic of online privacy with our special guest, Mark Weinstein. As a world-renowned author, TedX speaker, tech visionary, and privacy advocate, Mark brings unparalleled insight into the digital privacy landscape. We explore strategies to safeguard your online presence, regain control over your personal data, and thrive in an increasingly connected world. Mark also shares groundbreaking ideas from his award-winning book, "Restoring Our Sanity Online A Revolutionary Social Framework", offering a transformative approach to navigating the digital age. Don't...

S3 Episode 011 The Hitchhacker's Guide to the Cyberverse!

So, do you think your business is secure? Think again. This October, Jason and Kevin met with CompTIA's Wayne Selk, to uncover what businesses and individuals must know to stay ahead of today's online threats. Don't miss out on this essential conversation your online safety might just depend on it! An esteemed expert in the industry, Wayne brings over 25 years of cybersecurity expertise, helping businesses and individuals strengthen their defenses against online threats. From common phishing scams to advanced ransomware tactics, Wayne breaks down the latest in cybersecurity best practices and shares practical tips to keep you, your data,...

S3 Episode 010 The Art of the Pivot w/Wirefall

In this episode of the Cyber Distortion Podcast, we sit down with Dustin Dykes, better known as Wirefall, the founder of the Dallas Hackers Association (DHA). Join us as we dive into the origins of DHA, its impact on the cybersecurity community, and Wirefall's journey in the hacking world. Dustin is a Tribe of Hackers and Art of Intrusion Contributor, a public speaker, an improv and stand up student and performer, and of course, a technical guru! He is a local security community advocate. Founder of the Dallas Hackers Association and former board member of BSides DFW and TheLab.MS. He...

S3 Episode 009 He Robs Banks! w/FC (aka: Freaky Clown)

Welcome to this episode of Cyber Distortion, where we explore the cutting edge of technology, security, and the future of humanity itself. Today, Kevin and Jason have the privilege of talking with FC. FC or, "Freaky Clown" as he's known more commonly by his hacker handle, is a renowned ethical hacker and social engineer, as well as global keynote speaker. He has been working in the information security field for over 25 years and is motivated by a drive to make individuals, organizations, and countries more secure. When he is not legally breaking into companies, FC takes audiences on an...

S3 Episode 008 The Transhuman

Welcome to this episode of Cyber Distortion, where we explore the cutting edge of technology, security, and the future of humanity itself. Today, we have a truly extraordinary guest joining us: Len Noe, a Transhumanist with over 10 chips embedded in his body. Len isn't just a futuristhe's living proof of what the future could hold, using his integrated technology to perform hacks and complete takeovers on various devices. His unique perspective challenges the boundaries between human and machine, and today, he's here to share his incredible journey and insights with us. Len's path to becoming a white hat hacker...

S3 Episode 007 The Sociosploit

In today's episode, Kevin and Jason talk with a good friend Justin "Hutch" Hutchens. Hutch is a technology leader and visionary. He is the author of the book "The Language of Deception: Weaponizing Next Generation AI", the creator of Sociosploit.com, a research blog which examines exploitation opportunities on the social web a confluence of his interests in both technical hacking and social psychology, and the co-host of Cyber Cognition, a podcast focused on the rapidly evolving technical landscape of artificial intelligence and machine learning. Hutch is an award-winning public speaker and has spoken at multiple Universities and global conferences to...

S3 Episode 006 The Insane Impact of AI (FireTalks 15)

In this episode, Kevin and Jason hit 15 different topics on the Insane Impact of AI on our businesses, in our daily lives, in healthcare, and beyond. Each topic will be covered in 5 minutes or less in a new format we're calling "Firetalks 15!" The guys like to talk, and if you've listened to more than a few episodes, keeping any topic under 5 minutes proved to be a very challenging thing as you'll see in this interesting new format! Jason Popillion is a CISSP and serves as a CIO/CTO of a SaaS company and Kevin Pentecost is a...

S3 Episode 005 The Great Cyber Divide (w/ Special Guests: The Bare Knuckles & Brass Tacks Podcast Team)

In this episode, Kevin and Jason sit down to talk shop with George Kamide and George Al-Koura the hosts of the awesome podcast "Bare Knuckles and Brass Tacks." Their podcast is focused on talking about whether or not there truly is a vendor/customer divide. It's a cybersecurity podcast dedicated to answering that question. George Kamide comes from the vendor side, and George Al-Koura is a CISO on the customer side. They have REAL conversations from opposing sides of the pitch about cybersecurity marketing, sales, and go-to-market strategies. They confront these topics and bad practices with bare knuckles. Then it's down...

S3 Episode 004 The Dark Tale Teller with Jack Rhysider of Darknet Diaries

In this episode, Jason and Kevin sit down with the one and only storyteller from the dark side of the internet, Jack Rhysider. Jack is the beloved voice behind the extremely popular podcast The Darknet Diaries. Tonight, it's a podcaster-to-podcaster conversational happy hour! Jack attended a highly ranked university to study computer engineering with an emphasis on software engineering. Received formal training in Linux, Unix, Windows, C, C++, Java, ASM, logic, and electrical engineering. After college, he spent over a decade conducting network hardening by securing, analyzing, and testing network equipment such as firewalls, routers, and IDS units. Completed work...

S3 Episode 003 Alethe-Al Weapon with Alethe Denis

EPISODE DESCRIPTION: In this episode, we sit down with Sr. Security Consultant and Red Teamer, Alethe Denis. Alethe is a social engineer who excels in the art of human hacking. Alethe Denis is a Senior Security Consultant on the Red Team at Bishop Fox, an offensive cyber security company that helps clients protect their assets and data. She holds the Certified Ethical Hacker (CEH) certification and has multiple awards and publications in the field of social engineering and cybersecurity. Pursuing her passion for hacking she joined the cyber security industry after winning the prestigious DEF CON Social Engineering Capture the...

S3 Episode 002 Un-Bearably Dedicated!

EPISODE DESCRIPTION: In this episode, Kevin and Jason sit down to talk shop with Cyber-guru Phillip Wylie. Phillip is a friend and a member of the newly formed Cyber Circus network which includes other podcasters including Chris Glanden of BarCode Security as well as Kevin & Jason from the Cyber Distortion Podcast. Phillip Wylie is a well-known figure in the cybersecurity and ethical hacking community, recognized for his extensive experience and contributions to the field. Background and Expertise: Phillip has a background in penetration testing and ethical hacking. His career spans over two decades, during which he has held various...

S3 Episode 001 Down the Deepfake Rabbit Hole

In this episode, Kevin and Jason kick of what we expect will be our most exciting season to date. We come out of the gate like two savage wildebeests ready to devour anything in our path! Wait, that sounds extreme. Maybe it's on that intense, but it's LEGIT intense as we tackle a topic that only the fearless dare unpackage DEEPFAKES! In this octane fueled episode, we delve into the intricate world of deepfakes, a term that has rapidly evolved from obscure tech lingo to a hot-button issue at the intersection of technology, ethics, and reality. We give funny examples...

S2 - Episode 014 - Lone Star Cyber Circus - LIVE @ Hop & Sting Brewery, Grapevine, TX

Get ready for an electrifying evening as the "Lone Star Cyber Circus" pitches its virtual tent at the renowned Hop & Sting Brewery in Grapevine, Texas! This live podcast event, a harmonious blend of cutting-edge cyber talks and classic Texan hospitality, promises an experience like no other. As you step into the rustic yet modern ambiance of Hop & Sting Brewery, you'll be greeted by the rich aroma of craft beers, a hallmark of this beloved local establishment. The brewery's spacious interior, adorned with hints of Texan charm and cyber-themed dcor, sets the perfect stage for an evening of engaging...

S2 - Episode 013 CISSP Success Stories with Luke Ahmed Part II

Description: This is part two of our riveting two-part episode with the extraordinary Luke Ahmed. Luke, a best-selling author, CISSP instructor, and the driving force behind the immensely popular Facebook page "CISSP Exam Preparation - Study Notes and Theory," brings a wealth of knowledge and passion to the table. Discover the keys to success in the realm of cybersecurity as Luke shares insights from his personal journey and experience in the field. As a CISSP (Certified Information Systems Security Professional) instructor, he's not just a teacher; he's a mentor who has personally guided over 3300 aspiring CISSPs to success in...

S2 - Episode 012 CISSP Success Stories with Luke Ahmed Part I

In this riveting two-part episode, join us as we dive deep into the world of cybersecurity with the extraordinary Luke Ahmed. Luke, a best-selling author, CISSP instructor, and the driving force behind the immensely popular Facebook page "CISSP Exam Preparation - Study Notes and Theory," brings a wealth of knowledge and passion to the table. Discover the keys to success in the realm of cybersecurity as Luke shares insights from his personal journey and experience in the field. As a CISSP (Certified Information Systems Security Professional) instructor, he's not just a teacher; he's a mentor who has personally guided over...

S2 - Episode 011 "Cybersecurity Happy Hour - with Chris Glanden (BARCODE Security)"

In this episode, Kevin and Jason shoot the breeze with fellow Cybersecurity podcaster Chris Glanden, a veteran cybersecurity professional passionate about Security Systems, breakthroughs, vulnerabilities, their mitigation and risk management. Chris has interviewed some of the most high-profile influencers and specialists in technology, hacking, and cyberspace. His episodes include guests like Phillip Wylie, Freaky Clown (FC), Jack Rhysider from Darknet Diaries, Alyssa Miller, Gummo, and Magda Chelly to name a few!! Conceptualized in mid-2020 amongst the Covid pandemic, he designed BARCODE to become THE alternative way to continue the social and educational elements of cybersecurity happy hours, technical meet-ups and...

S2 - Episode 010 Quantum Branding: Turbocharge your Identity with AI

In this unconventional episode, Kevin and Jason are thrilled to welcome a true branding and growth specialist, Larry Roberts, famously known as the "Red Hat Guy." Larry brings a wealth of experience and knowledge in harnessing the power of AI tools to supercharge brand growth and visibility. Meet Larry Roberts - The 'Red Hat Guy' Larry Roberts has made a name for himself in the world of branding and marketing with his unique approach to using AI-driven strategies. As a seasoned expert in the field, he has successfully leveraged cutting-edge technology to help businesses and influencers thrive in the digital...

S2 - Episode 009 DEFCON An Exhaustive Guide to Hacker Summer Camp (with Dr. Louis DeWeaver)

This very special episode is our contribution to all existing or soon-to-be DEFCON attendees! We go deep under the covers to crack the shell of all things Hacker Summer Camp in this definitive, ALL YOU NEED TO KNOW, and truly exhaustive guide. We join forces with our good friend, who we met at Hacker Summer Camp, Dr. Louis DeWeaver. Louis is a former professor and a seasoned cybersecurity expert who brings years of knowledge and many trips to DEFCON to this conversation. His upbeat personality is one of a kind! We like to say that Louis could definitely sell ice...

S2 - Episode 008 Fighting Acronym Fatigue Part II with Dr. Aaron Estes (CEO - Ironwood Cyber)

In this follow-up episode, we are honored to continue our spirited discussion with (Dr. Aaron Estes Ironwood Cyber CEO "Chief Epic Officer") on with us to talk all about his company Ironwood Cyber, and some of the cool things they're doing over there. Ever since we met the Ironwood Cyber team based out of Ft. Worth Texas, we knew we had a solid professional passion and connection and we shared MANY similar interests. The Ironwood Cyber team is a strong group of Engineers originally founded by not one, but TWO Lockheed Martin Fellows respected for their incredible skillsets. Aaron Estes...

S2 - Episode 007 Fighting Acronym Fatigue Part I with Dr. Aaron Estes (CEO - Ironwood Cyber)

In this episode, we are honored to have one of these amazing gentlemen (Dr. Aaron Estes Ironwood Cyber CEO "Chief Epic Officer") on with us to talk all about his company Ironwood Cyber, and some of the cool things they're doing over there. Ever since we met the Ironwood Cyber team based out of Ft. Worth Texas, we knew we had a solid professional passion and connection and we shared MANY similar interests. The Ironwood Cyber team is a strong group of Engineers originally founded by not one, but TWO Lockheed Martin Fellows respected for their incredible skillsets. Aaron Estes...

S2 - Episode 006 You ARE the Weakest link!

A long time in the making, this episode on the importance of User Awareness may just be the most important episode we've released so far. Kevin Pentecost and Jason Popillion are security veterans and Certified Information Systems Security Professionals (CISSPs) who know their way around a good User Awareness Training program having personally trained in classroom led environments as well as fostered and matured their own corporate training programs over their years as Cybersecurity managers. Join us as the duo delve into the critical topic of Cybersecurity User Awareness. With their wealth of experience, they provided invaluable insights and practical...

S2 - Episode 005 Third Party Risk It's not Me, It's You!

HE'S BAAAAAAACK!! In this episode, we RE-visit with our very first guest, Benjamin Hall. Ben has served as a virtual CISO, and serves as Sr. Information Security Consultant at Heartland Business Systems. With experience in Governance, Risk, and Compliance, Ben has worked in several industries including Banking, Finance, Insurance, and Healthcare. He is a Certified Information Systems Auditor (CISA), a Certified Data Privacy Solutions Engineer (CDPSE), and a HITRUST Certified Common Security Framework Practitioner (CCSFP). He is skilled in DR (Disaster Recovery), BC (Business Continuity), IR (Incident Response), Documentation, Risk Management, Business Development, and Information Security. To say Ben is...

S2 - Episode 004 - "AI and ChatGPT is Scary Sh*t! Part II"

In this MUCH anticipated follow-up to our episode 003 on AI an ChatGPT, expect more mind-numbing and terrifying facts about this incredible new technology! Kevin and Jason wrap up their discussion with Justin "Hutch" Hutchins, a true pioneer in the field of AI and it's social impact in the world of Cybersecurity and beyond. The sole purpose of this episode is to touch the topic of AI and open your mind as to how you need to be thinking about it. How might AI intermingle with the world of Cybersecurity? Is this whole thing just another over-hyped topic that will...

S2 - Episode 003 - "AI and ChatGPT is Scary Sh*t! Part I"

What in the world does AI and ChatGPT have to do with Cybersecurity? Well, this episode is going to answer that question for you, and so much more!! In today's exciting episode, Jason and Kevin discuss the incredible world of AI with special guest and white hat hacker extraordinaire, Justin "Hutch" Hutchins. The sole purpose of this episode is to touch the topic of Ai and open your mind as to how you need to be thinking about it. How might AI intermingle with the world of Cybersecurity? Is this whole thing just another over-hyped topic that will fade away...

S2 - Episode 002 2022 Breaches and Some Retrospection

In this exciting second episode of the new season, we're offering up a buffet of delicious options to feast your incessant little cybersecurity appetites on! BREACHES We start by spending time on 5 of the top breaches that took place in 2022, but shift into some real world thoughts and ideas on what concepts could have helped in preventing those types of breaches. FRAMEWORKS Jason and Kevin dig deep into their CISSP bag of tricks to discuss cybersecurity frameworks and do a bit of a shallow dive into NIST, and then migrate into the CIS Top 18 cyber controls for...

S2 - Episode 001 The Dark Web Revisited

WE ARE BACK! Happy 2023 friends In this exciting episode of or BRAND NEW season 2, Kevin and Jason make good a promise from Season 1 where they go back and take a deep dive into the Dark Web. This time, we're coming with a purpose! We go back to investigate and see what's really out there and try to separate myth from reality. Have you always wondered what really exists out on the Dark Web? Do you have a curious bone just itching to go check it all out for yourself? Well, you're in luck! In this episode, you'll...

S1 - Episode 014 Women in Cybersecurity - Part II

There is a worldwide shortage of over 3 million in the ranks of cybersecurity professionals, with half a million of that shortage in North America alone. The problem is only expected to get worse as the demand for infosec talent is expected to grow dramatically in the coming months and years. One troubling fact about this shortage of talent is that the gap could be dramatically filled if only one segment of the population were proportionately represented in the cybersecurity industry women! Join us as Kevin, Jason, and their very special guests, Kristen Twining (Senior VP of Sales) and Madison...

S1 - Episode 013 Women in Cybersecurity - Part I

There is a worldwide shortage of over 3 million in the ranks of cybersecurity professionals, with half a million of that shortage in North America alone. The problem is only expected to get worse as the demand for infosec talent is expected to grow dramatically in the coming months and years. One troubling fact about this shortage of talent is that the gap could be dramatically filled if only one segment of the population were proportionately represented in the cybersecurity industry women! Join us as Kevin, Jason, and their very special guests, Kristen Twining (Senior VP of Sales) and Madison...

S1 - Episode 012 Unraveling the Zero Trust Mystery

If you're like many others in information security, you too may struggle with understanding the concept and basic premise of "zero trust." Well, we have good news for you! After this episode, you can rest-assured that we intend to clear the fog over this very confusing topic. Join us as Kevin, Jason, and their very special guest, Brad Moldenhauer as they help unravel the mystery of zero trust by bring in one of the resident experts on the topic. Brad is the VP and CISO at Z-Scaler who comes with a lengthy history in many facets of dealing with risk...

S1 - Episode 011 The Fine Art of Social Engineering

In this exciting episode, we cover the very fascinating topic of "Social Engineering" aka: Human Hacking! Anyone that lives in Cybersecurity knows that the weakest link in any company's cyber defenses is sitting between the keyboard and the chair. Tonight, we talk all about how malicious actors try to take full advantage of that weakness and exploit it to steal your company or your personal data. Join us as Jason and Kevin converse with a special guest Ragnhild "Bridget" Sageng on all facets of this controversial topic. Bridget has several years of experience in the IT industry, working with IT-support...

S1 - Episode 010 Doomsday Breach Prepping - 101

When the world comes crumbling down and your entire existence is burning to the ground, will you be prepared to handle it? What am I talking about anyway? The post-breach apocalypse, of course. What else?! You see, we have all heard it said so many times, "It's not a matter of IF you get breached; it's a matter of WHEN!" Well, if that is true, do you think you should be making every possible effort to get as prepared as possible ahead of time? We do! That is precisely why have handpicked the special guest for this episode. Stephen Cracknell...

S1 - Episode 009 #Badgelife ft. AND!XOR

Electronic Blinky-Bling?!! What the heck is that?! Take a quick walk around the Las Vegas strip around mid-summer at the DEFCON Hacking/Security Conference and you'll find out pretty darned quick! #BADGELIFE is a sub-culture of creators, hackers, programmers, and like-minded pseudo geniuses that craft some of the coolest electronic gadgetry you're ever going to see! Imagine a sea of LEDs dancing to the music of a DJs mix, on a PCB designed to look artsy and cool. Oh, also imagine that you can hack that bad boy and play games, and set the LCD screen to your favorite animated GIF....

S1 - Episode 008 Cybersecurity Insurance Protecting Your "ASS-ets"

In this episode, Jason and Kevin join guest Ross Ingersoll, Executive Risk & Cyber Account Executive at Holmes & Murphy & Associates. We discuss the topic of cyber insurance and how being protected from today's Cyber risks can better position your company in the event of a major breach event. If you've ever wondered about what Cyber Insurance covers, or what types of things you need to be considering before you even think about applying for Cyber Insurance, then this episode will hit home! In today's Cyber climate, does your company have the risk appetite to go without the added...

S1 Episode 007 The CISSP "EXPERIENCE"

In this episode, join Jason & Kevin as they discuss the journeys they both took to obtain the coveted CISSP (Certified Information Systems Security Professional) certification from the governing body of (ISC)2. Anyone who knows ANYTHING about Cybersecurity and has aspirations of becoming a manager know that the CISSP is the most sought after certification offered. In this episode, they discuss why that is. We also discuss the various domains covered in the exam, the weightings of each domain, the exam format, and many helpful tips and tricks to help get you over the hump as you traverse your studies....

S1 - Episode 006 Surviving Your First Regulatory Audit

In this episode, Jason & Kevin join special guest Stacie Grimm, Principal at UHY. UHY is one of the Midwest's leading CPA, business advisory and M&A firms. They deliver a broad range of tax, accounting, consulting and investment banking capabilities to serve businesses as well as individuals. Stacie brings 15 years of experience as a seasoned auditor to the conversation in this episode. In this episode we hit Stacie with questions around all the differences around company assessments, reports, audits, certifications and frameworks! We talk about Internal versus External audits, and we land on anything and everything SOC (System and...

S1 - Episode 005 - API Security Land Mines

In this episode, Jason and Kevin join guest Adam Fisher, Principal Security Engineer at Salt Security. We focus on a very common threat vector and component in modern web applications, the topic of API security. API security is the process of protecting APIs from attacks. Because APIs are very commonly used, and because they enable access to sensitive software functions and data, they are becoming a primary target for attackers. In this episode, we'll look at why API security is at an all-time high on the concerns lists for companies. If it's not on your top 5 list of concerns,...

S1 - Episode 004 - The Deep Dark Web

What is this mysterious online enigma? Maybe you've heard about it and wondered, "What type of craziness would I find out there?" Cybersecurity professionals and CISSP brothers, Jason and Kevin bring a hard-hitting and action packed episode centered on all of the mysteries the Dark Web has to offer. Join them as they navigate the waters of the various internet layers, the world of anonymity via the Onion Router (TOR). Finally, take a trip down the infamous Silk Road and follow it all the way to the illusive Red Room. Who knows? You may even find out the cost to...

S1 - Episode 003 - A Manager's Perspective on Cybersecurity

Jason and Kevin join guest Eric Lough, VP of Business Development at FCP Euro to discuss how managers think and make critical decisions around Cybersecurity. Eric brings over 15 years of experience in the Automotive Aftermarket to the table. We spend the majority of the episode picking his brain on several key questions on today's challenging decisions that most managers have to make as it relates to protecting their businesses. As you'll find out in this conversation, not all of these decisions are easy! Jason Popillion is a CISSP and serves as a CIO/CTO of a SaaS company and Kevin...

S1 - Episode 002 - Ransomware Part II

Jason and Kevin, both CISSP's and seasoned cybersecurity professionals, join guest David Bonvillain, VP of Sales Engineering for Halcyon.ai. David shares his 20+ years of experience to dive deep into Ransomware. David shares with the audience practical ways to keep yourself safe based on his years of reverse engineering malware and his deep understanding on how they are programmed to behave. He also takes on a historical review of Ransomware, where it started, how it progressed into a major business model and recent new developments discovered in the last 2 weeks on where it is going. We conclude with information...

S1 - Episode 001 - Ransomware Part I

Jason and Kevin, both CISSP's and seasoned cybersecurity professionals, join guest Benjamin Hall CISA, CDPSE, a cybersecurity consultant to break down key understandings of Ransomware. They share Ransomware horror stories and participate in a live simple Ransomware awareness quiz game produced by the FTC. They also discuss Senior Management buy-in and provide the audience with simple tools they can implement now so they can protect themselves and their companies. Jason Popillion is a CISSP and serves as a CIO/CTO of a SaaS company and Kevin Pentecost is a CISSP, CISM, CEH, CPT, MCSE, CCA, ITIL-F and serves as a Information...

S1 - Episode 000 - Welcome to the Cyber Distortion Podcast

Jason and Kevin, both CISSP's and seasoned cybersecurity professionals, breakdown 3 of the top Ransomware attacks of 2021. They give insights into why hackers found these vulnerabilities and help you understand why this podcast series is important to add to your podcast list for 2022.

Cyber Security Headlines

---

OpenAI's GPT-5.4-Cyber, McGraw Hill blames Salesforce for breach, signed adware disables antivirus

OpenAI rolls out GPT-5.4-Cyber McGraw Hill breach due to Salesforce misconfig Signed adware operation disables antivirus Get the show notes here: https://cisoseries.com/cybersecurity-news-openais-gpt-5-4-cyber-mcgraw-hill-blames-salesforce-for-breach-signed-adware-disables-antivirus/ Huge thanks to our sponsor, Conveyor At some point, every fast-growing SaaS team hits the same wall. The trust center is live. The SOC 2 is published. And somehow the security questionnaires just keep piling up. That's when teams realize a static trust center isn't the finish line. Conveyor is what comes next. AI that completes questionnaires automatically. A trust center customers can actually self-serve. And a knowledge base that updates itself with AI. Companies like Atlassian and...

Ransomware drama, faked Ledger app, Treasury wants Mythos

Ransomware rivals turn on each other Fake Ledger app drains millions in crypto US Treasury wants access to Mythos Get the show notes here: https://cisoseries.com/cybersecurity-news-ransomware-drama-faked-ledger-app-treasury-wants-mythos/ Huge thanks to our sponsor, Conveyor Your trust center was a great start. But if your team is still manually answering questionnaires and fielding sales questions, it hasn't solved the problem. Conveyor goes beyond a trust center. You get a living knowledge library your AI keeps up to date, questionnaire automation that handles any format, and a self-serve experience so customers and sales teams get answers without looping in infosec. Top enterprise SaaS companies trust...

Claude Mythos Preview's capabilities, Anodot breached companies face extortion, wolfSSL flaw enables forged certificates

Claude Mythos Preview's cyber capabilities Anodot hack leaves breached companies facing extortion wolfSSL library flaw enables forged certificate use Get the show notes here: https://cisoseries.com/cybersecurity-news-claude-mythos-previews-capabilities-anodot-breached-companies-face-extortion-wolfssl-flaw-enables-forged-certificates/ Huge thanks to our sponsor, Conveyor Three tools to manage customer security reviews is two too many. Most teams start with a trust center, bolt on a questionnaire tool, and end up with a knowledge base nobody trusts and a Slack channel full of sales pings anyway. Conveyor replaces all of it. Trust center, questionnaire automation, self-serve for sales, AI-managed knowledge library, one platform. Companies like Atlassian and Zapier already made the switch. See why...

The Department of Know is Moving to Fridays

A quick announcement: we're moving our Department of Know livestream to Fridays at 4pm ET/1 pm PT. The format will remain the same. We hope to see you there.

Adobe patches zero-day, Marimo flaw exploited, Venice flood threat

Adobe patches months-old Reader zero-day Critical Marimo flaw now under active exploitation Hackers claim control over Venice anti-flood pumps Get the show notes here: https://cisoseries.com/cybersecurity-news-adobe-patches-zero-day-marimo-flaw-exploited-venice-flood-threat/ Huge thanks to our sponsor, Conveyor Still manually filling out security questionnaires even though you have a trust center? A starter trust center is table stakes and the best security teams have moved way past that. Conveyor gives you an agentic trust center, AI questionnaire automation, and a self-serve layer so sales can move deals forward without pinging you every five minutes. Companies like Atlassian and Zapier made the switch. See why at conveyor.com.

Android API exposure, Acrobat Reader zero-day, Bitcoin Depot cyberattack

Google API keys in Android apps expose Gemini endpoints Acrobat Reader zero-day flaw exploited since December Cryptocurrency ATM company Bitcoin Depot reports cyberattack Check out our show notes here: https://cisoseries.com/cybersecurity-news-android-api-exposure-acrobat-reader-zero-day-bitcoin-depot-cyberattack/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping upand customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secureand keeps your deals moving. Learn more at vanta.com/ciso.

ChipSoft popped, APT28 updates, CIA cyber espionage elevation

Ransomware knocks Dutch healthcare vendor offline APT28 is keeping busy CIA quietly elevated its cyber espionage division Check out our show notes here: https://cisoseries.com/cybersecurity-news-chipsoft-popped-apt28-updates-cia-cyber-espionage-elevation/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping upand customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secureand keeps your deals moving. Learn more at vanta.com/ciso.

Anthropic's Project Glasswing, CISA funding in doubt, routers hijacked for passwords

Anthropic announces Project Glasswing U.S. seeks to slash CISA funding Russia-linked hackers hijack routers for passwords Check out our show notes here: https://cisoseries.com/cybersecurity-news-anthropics-project-glasswing-cisa-funding-in-doubt-routers-hijacked-for-passwords/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping upand customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secureand keeps your deals moving. Learn more at vanta.com/ciso.

Drift blames exploit on North Korea, GitHub attacks target South Korea, Die Linke breach threatens data leak

Drift says exploit was North Korean intelligence operation GitHub used in multi-stage attacks targeting South Korea Data leak threatened after Die Linke attack Check out our show notes here: https://cisoseries.com/cybersecurity-news-drift-blames-exploit-on-north-korea-github-attacks-target-south-korea-die-linke-breach-threatens-data-leak/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping upand customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secureand keeps your deals moving. Learn more at vanta.com/ciso.

Department of Know: Axios malware, TeamPCP campaign, New Storm infostealer

Link toepisode page This week's Department of Know is hosted by Sarah Lane, with guests Jack Kufahl,CISO,Michigan Medicine, andAdam Palmer, CISO,First Hawaiian Bank. Missed the live show? Check it outon YouTube. Huge thanks to our sponsor, Vanta Risk and regulation ramping upand customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secureand keeps your deals moving. Learn more at vanta.com/ciso.

Malicious npm packages, CISA budget cuts, hackers exploit React2Shell

36 Malicious npm packages exploited to deploy persistent implants Hundreds of millions to be cut from CISA in proposed budget Hackers exploit React2Shell in automated credential theft campaign Check out our show notes here: https://cisoseries.com/cybersecurity-news-malicious-npm-packages-cisa-budget-cuts-hackers-exploit-react2shell/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping upand customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secureand keeps your deals moving. Learn more at vanta.com/ciso.

Texas hospital breach, CISA orders NetScaler patch, ISO file RAT warning

250,000 affected by data Breach at Texas hospital CISA says, "patch Citrix NetScaler bug by Thursday" Researchers uncover mining operation using ISO lures Get the show notes here: https://cisoseries.com/cybersecurity-news-texas-hospital-breach-cisa-orders-netscaler-patch-iso-file-rat-warning/ Huge thanks to our sponsor, ThreatLocker Security controls fail when they break the business. Successful teams phase in protections gradually starting with visibility, then moving to enforcement. That approach allows organizations to reduce risk without overwhelming IT teams or disrupting critical workflows. Learn more at ThreatLocker.com

New iOS patches over DarkSword, FBI: surveillance hack is major incident, Cisco code stolen in Trivy-linked breach

Apple pushes new patches over DarkSword FBI: US surveillance hack is major incident Cisco code stolen in Trivy-linked breach Get the show notes here: https://cisoseries.com/cybersecurity-news-apple-pushes-new-patches-over-darksword-fbi-us-surveillance-hack-is-major-incident-cisco-code-stolen-in-trivy-linked-breach/ Huge thanks to our sponsor, ThreatLocker Detection-based security assumes you'll catch an attack in time. Control-based security assumes you won't. That mindset shift is driving more organizations to focus on preventative controls stopping unknown execution and unauthorized privilege elevation instead of relying solely on alerts after the fact. Learn more at ThreatLocker.com

Axios poisoned, TeamPCP details, Claude Code leaked

HTTP client introduces malicious dependency TeamPCP testing the open source supply chain Claude source code leaked Get the show notes here: https://cisoseries.com/cybersecurity-news-axios-poisoned-teampcp-details-claude-code-leaked/ Huge thanks to our sponsor, ThreatLocker Least privilege isn't about distrusting users it's about limiting blast radius. Many attacks succeed because malware inherits excessive permissions. Enforcing least privilege helps ensure that even if something goes wrong, attackers can't easily escalate access or move laterally across the environment. Learn more at ThreatLocker.com

macOS Terminal ClickFix attacks, Russian court sentences 'Flint', CareCloud probes data breach

macOS Terminal gets ClickFix attacks Russian court sentences 'Flint' over card fraud CareCloud probes data breach Get the show notes here: https://cisoseries.com/cybersecurity-news-macos-terminal-clickfix-attacks-russian-court-sentences-flint-carecloud-probes-data-breach/ Huge thanks to our sponsor, ThreatLocker Ransomware doesn't need to be sophisticated if it's allowed to execute. A growing number of security teams are shifting focus from detecting ransomware to preventing execution in the first place controlling applications, scripts, and installers so unauthorized code never gets the chance to run. Learn more at ThreatLocker.com

Department of Know: Gemini scours dark web, NSA worries about cybersecurity, APIs run loose

Link to episode page This week's Department of Know is hosted byRich Stroffolino with guests Dennis Pickett, vp, CISO, RTI International, and Jacob Combs, CISO, Tandem Diabetes Care Thanks to our show sponsor, ThreatLocker Many security strategies still assume everything is allowed until proven malicious. Attackers understand that model well. That's why more organizations are rethinking endpoint security shifting from detection-first tools to control-first approaches that reduce attack surface before an incident occurs. Learn more at ThreatLocker.com All links and the video of this episode can be found on CISO Series.com

FBI email theft, Lloyds Bank glitch, API keys running loose

FBI confirms theft of director's personal emails Lloyds customer data exposed in IT glitch Hundreds of valid API keys discovered on the Web Get the show notes here: https://cisoseries.com/cybersecurity-news-fbi-email-theft-lloyds-bank-glitch-api-keys-running-loose/ Huge thanks to our sponsor, ThreatLocker Most breaches don't start with a zero-day they start because something unexpected was allowed to run. One way organizations reduce risk is by shrinking the attack surface: deciding what software should be allowed to execute and blocking everything else by default. Fewer unknowns means fewer opportunities for attackers. Learn more at ThreatLocker.com

Alleged RedLine dev extradited, Red Menshen spies with BPFDoor, is US cybersecurity slipping?

Alleged RedLine dev extradited to US Red Menshen uses BPFDoor to spy Former NSA chiefs worry US cybersecurity is slipping Check out our show notes for all story links: https://cisoseries.com/cybersecurity-news-alleged-redline-dev-extradited-red-menshen-spies-with-bpfdoor-is-us-cybersecurity-slipping/ Huge thanks to our sponsor, ThreatLocker Security controls fail when they break the business. Successful teams phase in protections gradually starting with visibility, then moving to enforcement. That approach allows organizations to reduce risk without overwhelming IT teams or disrupting critical workflows. Learn more at ThreatLocker.com

Torg Grabber targets crypto, TeamPCP backdoors LiteLLM, GitHub AI bug detection

Torg Grabber targets crypto wallets TeamPCP backdoors LiteLLM GitHub adds AI security bug detection Check out our show notes for all story links: https://cisoseries.com/cybersecurity-news-torg-grabber-targets-crypto-teampcp-backdoors-litellm-github-ai-bug-detection/ Huge thanks to our sponsor, ThreatLocker Detection-based security assumes you'll catch an attack in time. Control-based security assumes you won't. That mindset shift is driving more organizations to focus on preventative controls stopping unknown execution and unauthorized privilege elevation instead of relying solely on alerts after the fact. Learn more at ThreatLocker.com

FCC router ban, drone hit AWS, Crunchroll leak

FCC bans foreign routers Drone activity disrupts AWS region Crunchyroll confirmed data leak Check out our show notes for all story links: https://cisoseries.com/cybersecurity-news-fcc-router-ban-drone-hit-aws-crunchroll-leak/ Huge thanks to our sponsor, ThreatLocker Least privilege isn't about distrusting users it's about limiting blast radius. Many attacks succeed because malware inherits excessive permissions. Enforcing least privilege helps ensure that even if something goes wrong, attackers can't easily escalate access or move laterally across the environment. Learn more at ThreatLocker.com

DarkSword exploit hits GitHub, Gemini AI agents scour dark web, Trivy supply chain attack expands

New DarkSword exploit hits GitHub Gemini AI agents scour the dark web Trivy supply chain attack expands Check out our show notes for all story links: https://cisoseries.com/cybersecurity-news-darksword-exploit-hits-github-gemini-ai-agents-scour-dark-web-trivy-supply-chain-attack-expands/ Huge thanks to our sponsor, ThreatLocker Ransomware doesn't need to be sophisticated if it's allowed to execute. A growing number of security teams are shifting focus from detecting ransomware to preventing execution in the first place controlling applications, scripts, and installers so unauthorized code never gets the chance to run. Learn more at ThreatLocker.com

Department of Know: SaaS apps enable breaches, real-time cyber protection, IoT botnet takedown

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Bil Harmer, CISO, Supabase, and Chris Ray, Field CTO, GigaOm Thanks to our show sponsor, ThreatLocker Many security strategies still assume everything is allowed until proven malicious. Attackers understand that model well. That's why more organizations are rethinking endpoint security shifting from detection-first tools to control-first approaches that reduce attack surface before an incident occurs. Learn more at ThreatLocker.com All links and the video of this episode can be found on CISO Series.com

International botnet takedown, California city ransomed, Azure Monitor phishing

Law enforcement seizes botnet infrastructure California city and LA transit agency report cybersecurity issues Microsoft Azure Monitor alerts used for callback phishing attacks Check out our show notes for all story links: https://cisoseries.com/cybersecurity-news-cybersecurity-news-international-botnet-takedown-california-city-ransomed-azure-monitor-phishing/ Huge thanks to our sponsor, ThreatLocker Most breaches don't start with a zero-day they start because something unexpected was allowed to run. One way organizations reduce risk is by shrinking the attack surface: deciding what software should be allowed to execute and blocking everything else by default. Fewer unknowns means fewer opportunities for attackers. Learn more at ThreatLocker.com

Critical SharePoint flaw, real-time cyberattack prevention, CISA's Intune warning

Critical Microsoft SharePoint flaw now exploited in attacks 1stProtect reveals endpoint security platform intended to prevent cyberattacks in real time CISA urges U.S. organizations to secure Microsoft Intune systems following Stryker breach Get links to all our stories in the show notes: https://cisoseries.com/cybersecurity-news-critical-sharepoint-flaw-real-time-cyberattack-prevention-cisas-intune-warning/ Huge thanks to our episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Picture a "new hire" who interviews well except they're synthetic: AI video, AI voice, AI backstory. Once they're in, they go after payroll, internal docs, and access. That's the...

DarkSword emerges, "ShieldGuard" dismantled, NK IT worker army rakes in money

DarkSword emerges from suspected Russian hackers "ShieldGuard" dismantled after malware discovery North Korea's fake IT worker army rakes in $500M/year Get links to all our stories in the show notes: https://cisoseries.com/cybersecurity-news-darksword-emerges-shieldguard-dismantled-nk-it-worker-army-rakes-in-money/ Huge thanks to our episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Picture a "new hire" who interviews well except they're synthetic: AI video, AI voice, AI backstory. Once they're in, they go after payroll, internal docs, and access. That's the new reality: the attack surface is trust itself. Adaptive fights back with...

Energy strategy, scammer accord, font-rendering attack

Energy Department to release first cyber strategy Tech giants sign on to fight scammers Font-rendering hides malicious commands from AI in plain sight Get links to all our stories in the show notes: https://cisoseries.com/cybersecurity-news-energy-strategy-scammer-accord-font-rendering-attack/ Huge thanks to our episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Attackers don't need malware anymore; they need trust. Tip: set a simple passphrase for high-risk actions, like wire requests or "urgent" account recovery especially within finance teams and families. If the caller can't answer it, pause and verify....

Stryker hospital tools safe, models apply to power AI scams, cybercrime up 245%

Stryker hospital tools safe, digital ordering services down Models apply to be the face of AI scams Cybercrime up 245% since Iran conflict Get links to all our stories in the show notes: https://cisoseries.com/cybersecurity-news-stryker-hospital-tools-safe-models-apply-to-power-ai-scams-cybercrime-up-245/ Huge thanks to our episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Today's phishing doesn't just hit inboxes it can sound like your CFO or look like your CEO on Zoom. AI voices, video, and deepfakes are turning trust into the attack surface. Adaptive fights back with AI-driven risk scoring,...

Department of Know: OpenAI vulnerability scanner, US new cyber strategy, VPN SEO poisoning

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Jonathan Waldrop, CISO, Acoustic, and Chris Ray, Field CTO, GigaOm Thanks to our show sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Deepfakes aren't science fiction anymore; they're a daily threat. Quick tip: if your voicemail greeting is your real voice, switch it to the default robot voice. A few seconds of audio can be enough to clone you. Adaptive helps teams spot and stop these AI-powered social engineering...

Royal Bahrain Hospital breach, Canada's Loblaw breached, New York water laws

Payload Ransomware group claims breached of Royal Bahrain Hospital Canadian food retailer Loblaw confirms data breach New York cyber regulations for water organizations launch in 2027 Get links to all our stories in the show notes: https://cisoseries.com/cybersecurity-news-royal-bahrain-hospital-breach-canadas-loblaw-breached-new-york-water-laws/ Huge thanks to our episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Deepfakes aren't science fiction anymore; they're a daily threat. Quick tip: if your voicemail greeting is your real voice, switch it to the default robot voice. A few seconds of audio can be enough to...

Iran boosts cyberattacks, VENON targets Brazilian banks, England Hockey investigates breach

Iran boosts cyberattacks VENON targets Brazilian banks England Hockey investigates breach Get links to all the stories in our show notes: https://cisoseries.com/cybersecurity-news-iran-boosts-cyberattacks-venon-targets-brazilian-banks-england-hockey-investigates-breach/ Huge thanks to our sponsor, Dropzone AI If you are heading to RSAC next week, here are three things worth seeing at the Dropzone AI Diner. Booth 455, South Expo Hall. One: watch their AI SOC agents investigate real alerts live, with every reasoning step exposed. Two: meet the AI Threat Hunter, the newest agent joining the team. Three: enter the investigation competition and go head to head against the AI. Schedule your stop at dropzone.ai/rsa-2026-ai-diner.

Meta apps offer new scam protection, Google's Wiz acquisition finalized, China curbs state-run OpenClaw use

Meta apps offer new scam protection Google's Wiz acquisition finalized China curbs state-run OpenClaw use Get links to all the stories in our show notes: https://cisoseries.com/cybersecurity-news-meta-offers-scam-protection-googles-wiz-acquisition-finalized-china-curbs-openclaw-use/ Huge thanks to our sponsor, Dropzone AI Here is something worth asking any AI security vendor you meet at RSAC. Can you show me exactly what your AI did? Not just the verdict. The reasoning. Every tool it queried, every piece of evidence, every step it took to get there. Most cannot. Dropzone AI can. Every investigation is fully transparent. You do not have to trust the AI. You can verify it. See it...

New Cyber Command chief, Russia targets Signal, Codex Security

NSA and Cyber Command head confirmed Russians targeting encrypted messaging app users OpenAI rolls out vulnerability scanner Get links to all the stories in our show notes: https://cisoseries.com/cybersecurity-news-march-11-2026/ Huge thanks to our sponsor, Dropzone AI Remember yesterday's 3 AM threat intel? Here is how it plays out with Dropzone AI. The intelligence drops. Dropzone picks it up, turns it into a threat hunt, and runs it across your SIEM, EDR, and cloud data while your team sleeps. By morning, your analysts have answers, not a backlog. That is the AI Threat Hunter, the newest agent on the team, debuting at...

InstallFix spreads fake Claude sites, UNC4899 breaches crypto, UK cyber-fraud crackdown

InstallFix attacks spread fake Claude code sites UNC4899 breaches crypto firm via trojanized file UK launches cyber-fraud crackdown unit Get links to all the stories in our show notes: https://cisoseries.com/cybersecurity-news-installfix-spreads-fake-claude-sites-unc4899-breaches-crypto-uk-cyber-fraud-crackdown/ Huge thanks to our sponsor, Dropzone AI It is 3 AM. New threat intelligence drops. An attack pattern targeting your industry. Your threat hunting team is four people, all on day shift, and already behind on last week's hunts. By the time someone gets to it, the window for early detection has closed. The attacker is already inside. Tomorrow, I will tell you what Dropzone AI is bringing to RSAC...

Department of Know: Quantum-Safe certificates, Iranian cyberattack risks, 90 zero-days

Link to episode page This week's Department of Know is hosted by Sarah Lane with guests John Barrow, CISO, JB Poindexter & Co., and Derek Fisher, Director of the Cyber Defense and Information Assurance Program, Temple University Thanks to our show sponsor, Dropzone AI Here is a number worth knowing before RSAC. The average enterprise SOC sees tens of thousands of alerts a day. Most get triaged. A fraction get thoroughly investigated. The rest sit in the queue or get auto-closed. Dropzone AI puts AI SOC agents on every one of those alerts. Every alert investigated, end to end, across...

FBI network breach, GitHub distributes stealer, Hackers abuse .arpa

FBI investigates suspicious activities on agency network Over 100 GitHub repositories distributing BoryptGrab stealer Hackers abuse .arpa DNS and ipv6 to evade phishing defenses Get links to all the stories in our show notes: https://cisoseries.com/cybersecurity-news-fbi-network-breach-github-distributes-stealer-hackers-abuse-arpa/ Huge thanks to our sponsor, Dropzone AI Here is a number worth knowing before RSAC. The average enterprise SOC sees tens of thousands of alerts a day. Most get triaged. A fraction get thoroughly investigated. The rest sit in the queue or get auto-closed. Dropzone AI puts AI SOC agents on every one of those alerts. Every alert investigated, end to end, across your full...

Apple blocks ByteDance, Google's 90 zero-days, Iran backdoors U.S. organizations

Apple blocks ByteDance Chinese apps Google says 90 zero-days were exploited in attacks last year Iran intelligence backdoored U.S. bank, airport, software outfit networks Get the show notes here: https://cisoseries.com/cybersecurity-news-apple-blocks-bytedance-googles-90-zero-days-iran-backdoors-u-s-organizations/ Huge thanks to our sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Security training fails when it's generic. Adaptive's platform personalizes training and runs deepfake simulations across email, SMS, voice, and video. And with Adaptive's AI Content Creator, you can drop in a breaking threat or compliance doc and instantly turn it into interactive, multilingual...

Possible iPhone-hacking toolkit used by spies, Hacker mass-mails HungerRush extortion emails, Tycoon 2FA phishing platform dismantled

Possible iPhone-hacking toolkit used by spies Hacker mass-mails HungerRush extortion emails Tycoon 2FA phishing platform dismantled Get the show notes here: https://cisoseries.com/cybersecurity-news-iphone-hacking-toolkit-used-by-spies-hungerrush-extortion-emails-tycoon-phishing-platform-dismantled/ Huge thanks to our sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Picture a "new hire" who interviews well except they're synthetic: AI video, AI voice, AI backstory. Once they're in, they go after payroll, internal docs, and access. That's the new reality: the attack surface is trust itself. Adaptive fights back with realistic deepfake simulations and training that actually sticks. adaptivesecurity.com.

Quantum decryption, OpenAI's deal, South Korea leaks crypto keys

Quantum decryption gets theoretically easier OpenAI alters the deal with the Pentagon South Korea leaks crypto keys for all to see Get the show notes here: https://cisoseries.com/cybersecurity-news-quantum-decryption-openais-deal-south-korea-leaks-crypto-keys/ Huge thanks to our sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Attackers don't need malware anymore; they need trust. Tip: set a simple passphrase for high-risk actions, like wire requests or "urgent" account recovery especially within finance teams and families. If the caller can't answer it, pause and verify. Adaptive runs deepfake and vishing simulations so employees...

Chrome quantum-safe certificates, Gemini Live vulnerability, UK warns of Iranian cyberattacks

Chrome unveils quantum-safe certificates Vulnerability allowed hijacking Gemini Live UK warns of Iranian cyberattack risks Get the show notes here: https://cisoseries.com/cybersecurity-news-chrome-quantum-safe-certificates-gemini-live-vulnerability-uk-warns-of-iranian-cyberattacks/ Huge thanks to our sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Today's phishing doesn't just hit inboxes it can sound like your CFO or look like your CEO on Zoom. AI voices, video, and deepfakes are turning trust into the attack surface. Adaptive fights back with AI-driven risk scoring, deepfake simulations featuring your own executives, and interactive training your team will actually remember....

Department of Know: iPhone, iPad and Grok get greenlight, WiFi gets snitched

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Dan Holden, CISO, Commerce, and Mark Eggleston, CISO, CSC Thanks to our show sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. AI is rewriting the cybersecurity rulebook, because attackers can now scale persuasion as easily as they scale code. The real target isn't just your systems anymore; it's human trust. If you aren't actively testing your organization against AI-driven phishing, vishing, and deepfakes, you're leaving a gap criminals will...

Gottumukkala ousted, Wyden blocks Rudd, Hackers weaponize Claude

Gottumukkala ousted as CISA Director Ron Wyden blocks Rudd confirmation to lead Cyber Command, NSA Hackers Weaponize Claude Code in Mexican government cyberattack Get the show notes here: https://cisoseries.com/cybersecurity-news-gottumukkala-ousted-wyden-blocks-rudd-hackers-weaponize-claude/ Huge thanks to our sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Deepfakes aren't science fiction anymore; they're a daily threat. Quick tip: if your voicemail greeting is your real voice, switch it to the default robot voice. A few seconds of audio can be enough to clone you. Adaptive helps teams spot and stop these...

NATO adopts Apple, Education and Healthcare backdoor, Apex One flaws

iPhone and iPad cleared for classified NATO work U.S. Education and Healthcare targeted with Dohdoor backdoor Trend Micro warns of critical Apex One code execution flaws Get links to all of today's news in our show notes here: https://cisoseries.com/cybersecurity-news-nato-adopts-apple-education-and-healthcare-backdoor-apex-one-flaws/ Thanks to today's episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Security training fails when it's generic. Adaptive's platform personalizes training and runs deepfake simulations across email, SMS, voice, and video. And with Adaptive's AI Content Creator, you can drop in a breaking threat or...

Google disrupts UNC2814, 3M+ impacted by TriZetto breach, Cisco bug exploited since 2023

Google disrupts UNC2814 3M+ impacted by TriZetto breach Cisco bug exploited since 2023 Get links to all of today's news in our show notes here: Thanks to today's episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Picture a "new hire" who interviews well except they're synthetic: AI video, AI voice, AI backstory. Once they're in, they go after payroll, internal docs, and access. That's the new reality: the attack surface is trust itself. Adaptive fights back with realistic deepfake simulations and training that actually...

Hacked in 30 minutes, Claude distillation, DeFi shutdown after attack

Threat actors break out in under 30 minutes Claude allegedly hit with distillation attacks DeFi platform shutting down after crypto theft Get links to all of today's news in our show notes here: https://cisoseries.com/cybersecurity-news-hacked-in-30-minutes-claude-distillation-defi-shutdown-after-attack/ Thanks to today's episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Attackers don't need malware anymore; they need trust. Tip: set a simple passphrase for high-risk actions, like wire requests or "urgent" account recovery especially within finance teams and families. If the caller can't answer it, pause and verify. Adaptive...

US healthcare breach affects 140k, experts warn against replicating humans, Shai-Hulud-like worm targets devs

140k affected by US healthcare breach Data advocates warn against replicating humans Shai-Hulud-like worm targets developers Get links to all of today's news in our show notes here: https://cisoseries.com/cybersecurity-news-us-healthcare-breach-affects-140k-experts-warn-against-replicating-humans-shai-hulud-like-worm-targets-devs/ Thanks to today's episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Today's phishing doesn't just hit inboxes it can sound like your CFO or look like your CEO on Zoom. AI voices, video, and deepfakes are turning trust into the attack surface. Adaptive fights back with AI-driven risk scoring, deepfake simulations featuring your own executives,...

Department of Know: Chrome zero-day, exploits, Copilot summarizes confidential emails, Identity abuse problems

Link to episode page This week's Department of Know is hosted byRich Stroffolinowith guestsMontez Fitzpatrick, CISO,Navvis, andPeter Gregory, author. Thanks to our show sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. AI is changing phishing, because persuasion now scales like code. And it's not just email anymore; attackers hit SMS, voice calls, and multi-step scams that jump channels. Adaptive runs AI-powered phishing simulations across email, SMS, and voice, including OSINT-based spearphishing and BEC-style scenarios, so employees practice what attacks look like. Learn more atadaptivesecurity.com. All...

Arkanix was POC, 600 Fortinet firewalls breach, Russia heightens tension

Arkanix Stealer the new AI info-stealer experiment AI-assisted hacker breached 600 Fortinet firewalls in 5 weeks Russia stepping up hybrid attacks, preparing for confrontation with West Get links to all of today's news in our show notes here: https://cisoseries.com/cybersecurity-news-arkanix-was-poc-600-fortinet-firewalls-breach-russia-heightens-tension/ Thanks to today's episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Deepfakes aren't science fiction anymore; they're a daily threat. Quick tip: if your voicemail greeting is your real voice, switch it to the default robot voice. A few seconds of audio can be enough...

CISA's DELL order, Android AI malware, browsers as weak link

CISA orders urgent patch of Dell flaw Android malware uses Gemini to navigate infected devices Half of all cyberattacks start in the browser, says Palo Alto Networks Get the full show notes here: https://cisoseries.com/cybersecurity-news-cisas-dell-order-android-ai-malware-browsers-as-weak-link/ Huge thanks to our sponsor, Conveyor Most of what Conveyor automates is boring. Like really boring. Security questionnaires. Customer requests for things like your SOC 2. All of their follow-up questions. Answering tickets from your sales team. You know what's not boring? Alteryx using Conveyor to support over half a billion dollars in enterprise deals with a small 4 person team. All they did was set...

Copilot summarizes confidential emails, ShinyHunters targets CarGurus, Texas sues TP-Link

Microsoft Copilot summarizes confidential emails ShinyHunters takes CarGurus records Texas sues TP-Link over router hack Get the full show notes here: https://cisoseries.com/cybersecurity-news-copilot-summarizes-confidential-emails-shinyhunters-targets-cargurus-texas-sues-tp-link/ Huge thanks to our sponsor, Conveyor Every fast-growing company hits this one moment. Sales wants to close bigger enterprise deals, but this means the security team is buried in security questionnaires. Alteryx avoided the deluge of questionnaires by using Conveyor to automate their customer security reviews.The result? AI completes questionnaires, 40% more customers are supported through a self-serve trust center, and over half a billion dollars in security influenced revenue. If you're trying to scale without adding headcount,...

Hacking protestors, UK "locks the door," Kenyan politician phone cracked

Hackers target anti-government protestors UK launches "lock the door" cybersecurity campaign Cellebrite linked to phone hack on Kenyan politician Get the full show notes here: https://cisoseries.com/cybersecurity-news-hacking-protestors-uk-locks-the-door-kenyan-politician-phone-cracked/ Huge thanks to our sponsor, Conveyor Most of what Conveyor automates is boring. Like really boring. Security questionnaires. Customer requests for things like your SOC 2. All of their follow-up questions. Answering tickets from your sales team. You know what's not boring? Alteryx using Conveyor to support over half a billion dollars in enterprise deals with a small 4 person team. All they did was set up an AI trust center and use Conveyor's...

Eurail traveler data for sale, EU Parliament blocks AI features, Washington Hotel discloses ransomware hit

Eurail stolen traveler data now up for sale EU Parliament blocks AI features Japan's Washington Hotel discloses ransomware hit Get the full show notes here: Huge thanks to our sponsor, Conveyor Here's a fun question. Would you rather support more enterprise deals or answer fewer security questionnaires? Moving upmarket usually means more scrutiny and more security questions. Instead of hiring more people or slowing sales, Alteryx used Conveyor's AI to automate customer security reviews like questionnaires, SOC 2 requests, and all the back-and-forth. They supported 200% growth and over half a billion dollars in pipeline with a 4 person team....

Department of Know: VoidLink threatens multi-cloud, flaw threatens Claude extension, China practices on infrastructure

Link to episode page This week's Department of Know is hosted by Sarah Lane with guests Jon Collins, Field CTO, GigaOm, and Adam Palmer, CISO, First Hawaiian Bank Thanks to our show sponsor, Conveyor Ever dream of giving customers instant answers to their security questions without ever filling out another questionnaire? Meet Conveyor's new Trust Center Agent. The Agent lives in your Conveyor Trust Center and answers every customer question, surfaces documents and even completes full questionnaires instantly so customers can finish their review and be on their way. Top tech companies like Atlassian, Zapier, and more are using Conveyor...

Ivanti actor identified, search overviews manipulated, ClickFix leverages Nslookup

One threat actor responsible for 83% of recent Ivanti RCE attacks Google's AI search overviews manipulated by scammers Microsoft warns of DNS-based ClickFix attack that uses Nslookup Get the full show notes here: https://cisoseries.com/cybersecurity-news-ivanti-actor-identified-search-overviews-manipulated-clickfix-leverages-nslookup/ Huge thanks to our sponsor, Conveyor I'll tell you two things Conveyor can't help you with. Conveyor will not make security questionnaires fun and it will not make your sales team stop asking you questions. But it did help Alteryx support half a billion dollars in enterprise deals with the same 4 person team. All they did was get an AI trust center and use Conveyor's...

Hackers abuse Gemini, Apple patches ancient bug, CISA criticizes shutdown

Hackers abuse Gemini AI for all attack stages, says Google Apple patches decade-old possibly exploited iOS zero-day Acting CISA chief critiques potential DHS funding lapse Get the show notes here: https://cisoseries.com/cybersecurity-news-hackers-abuse-gemini-apple-patches-ancient-bug-cisa-criticizes-shutdown/ Huge thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com.

Crazy gang abuses employee monitoring tool, Nevada unveils new data classification, Georgia healthcare breach impact grows

Crazy gang abuses employee monitoring tool Nevada unveils new data classification Georgia healthcare breach impacts more than 620,000 Get the show notes here: https://cisoseries.com/cybersecurity-news-google-gets-eu-wiz-approval-microsoft-secures-secure-boot-certificates-north-korean-hackers-target-crypto-exec/ Huge thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com.

Google gets EU Wiz approval, Microsoft secures Secure Boot certificates, North Korean hackers target crypto exec

EU grants Google approval for Wiz Microsoft rolls out Secure Boot certificates before expiration North Korean hackers target crypto exec Get the show notes here: https://cisoseries.com/cybersecurity-news-google-gets-eu-wiz-approval-microsoft-secures-secure-boot-certificates-north-korean-hackers-target-crypto-exec/ Huge thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com.

UNC3886 targets Singapore telecoms, VoidLink exhibits multi-cloud capabilities and AI code, 135,000+ OpenClaw instances exposed

UNC3886 targets Singapore telecom sector VoidLink exhibits multi-cloud capabilities and AI code 135,000+ OpenClaw instances exposed to internet Get the show notes here: https://cisoseries.com/cybersecurity-news-february-10-2026/ Huge thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com.

Department of Know: GSA's CMMC requirements, AWS intruder AI heist, Moltbook raises the stakes

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Nick Ryan, former CISO, and Chris Ray, Field CTO, GigaOm Thanks to our show sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com. All links and the video of this episode can be found on CISO Series.com

OpenClaw embraces VirusTotal, CISA EOL Deadline, ransomware hits BridgePay

OpenClaw turns to VirusTotal to boost security CISA gives federal agencies one year to remove end-of-life devices Payments platform BridgePay confirms ransomware attack Get the show notes here: https://cisoseries.com/cybersecurity-news-openclaw-embraces-virustotal-cisa-eol-deadline-ransomware-hits-bridgepay/ Huge thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com.

Substack admits breach, Russian attacks target Winter Olympics, GitHub Codespaces enable RCE

Substack admits data breach Russian attacks target Winter Olympics GitHub Codespaces enable RCE Get the show notes here: Huge thanks to our sponsor, Strike48 It's no secret that AI is only as good as the data available to it. Strike48 unifies agentic AI with unmatched log visibility while avoiding the typical hefty price tag. Build and deploy agents for phishing detection, alert triage, threat correlation and more. Queries existing logs where they currently live, so you can keep the technology you already have. Learn more at Strike48.com.

Ukraine tightens controls on Starlink terminals, VMware ESXi flaw now exploited, SolarWinds Web Help Desk bug under attack

Ukraine tightens controls on Starlink terminals VMware ESXi flaw now exploited SolarWinds Web Help Desk bug under attack Get the show notes here: https://cisoseries.com/cybersecurity-news-ukraine-tightens-controls-on-starlink-terminals-vmware-esxi-flaw-now-exploited-solarwinds-web-help-desk-bug-under-attack/ Huge thanks to our sponsor, Strike48 Strike48 is the Agentic Log Intelligence Platform that actually puts AI agents to work, maximizing log visibility without blowing your budget. Find threats your siloed tools miss. Get started today with pre-built AI agents and workflows that investigate, detect, and respond 24/7 or build your own at strike48.com/security.

Metro bug, more social bans, leaky Moltbook

React Native Metro bug impacts thousands of servers Greece and Spain set to ban social media for kids Moltbook shows the dangers of vibe coding Get the show notes here: https://cisoseries.com/cybersecurity-news-metro-bug-more-social-bans-leaky-moltbook/ Huge thanks to our sponsor, Strike48 Security teams are stretched. Attack surfaces and threat volumes keep growing, meanwhile SOC budgets stay flat and glorified chatbots with hallucination problems aren't helping. Strike48 is different. Agents scale independently, running investigations across your logs while your team can concentrate on the highest priority tasks that require human judgment and decision making. Try it today at Strike48.com/security.

OpenClaw targets ClawHub users, Notepad++ update delivers malware, APT28 attackers abuse Microsoft Office zero-day

OpenClaw targets ClawHub users Notepad++ update delivers malware APT28 attackers abuse Microsoft Office zero-day Get the show notes here: https://cisoseries.com/cybersecurity-news-openclaw-targets-clawhub-users-notepad-update-delivers-malware-apt28-attackers-abuse-microsoft-office-zero-day/ Huge thanks to our sponsor, Strike48 It's no secret that AI is only as good as the data available to it. Strike48 unifies agentic AI with unmatched log visibility while avoiding the typical hefty price tag. Build and deploy agents for phishing detection, alert triage, threat correlation and more. Queries existing logs where they currently live, so you can keep the technology you already have. Learn more at Strike48.com.

Department of Know: CISA's cryptography categories, Gottumukkala's ChatGPT gotcha, NTLM says goodbye

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Steve Zalewski, co-host, Defense in Depth, and Nick Espinosa, host, The Deep Dive Radio Show Thanks to our show sponsor, Devo/Strike 48 Strike48 is the Agentic Log Intelligence Platform that actually puts AI agents to work, maximizing log visibility without blowing your budget. Find threats your siloed tools miss. Get started today with pre-built AI agents and workflows that investigate, detect, and respond 24/7 or build your own at strike48.com/security. All links and the video of this episode can be found on CISO Series.com

Police question Coupang CEO, Russia bakery cyberattack, Australian real estate scandal

Coupang CEO questioned by police regarding data breach probe Cyberattack on large Russian bread factory disrupts deliveries Real estate agents in Australia use apps that leave lease documents at risk Get the show notes here: https://cisoseries.com/cybersecurity-news-police-question-coupang-ceo-russia-bakery-cyberattack-australian-real-estate-scandal/ Huge thanks to our sponsor, Strike48 Strike48 is the Agentic Log Intelligence Platform that actually puts AI agents to work, maximizing log visibility without blowing your budget. Find threats your siloed tools miss. Get started today with pre-built AI agents and workflows that investigate, detect, and respond 24/7 or build your own at strike48.com/security.

France fines unemployment agency, Teams flags calls, UK pushes deterrence

France fines unemployment agency 5 million over data breach Microsoft Teams addition will allow for suspicious calls to be reported UK leaders warned about absorbing cyberattacks without offensive deterrence Check out the show notes here: Huge thanks to our episode sponsor, Conveyor Want to hear a horror story? An infosec manager found out that their sales rep had filled in a customer security questionnaire themselves and sent it back to the customer without review. Which led to dozens of follow up questions. With Conveyor's Trust Center AI Agent, you can avoid all of that. The Agent lives in your Conveyor...

Sandbox flaw exposes n8n instances, Fake Moltbot assistant drops malware, PeckBirdy takes flight for cross-platform attacks

Sandbox flaw exposes n8n instances Fake Moltbot assistant drops malware PeckBirdy takes flight for cross-platform attacks Check out the show notes here: https://cisoseries.com/cybersecurity-news-sandbox-flaw-exposes-n8n-instances-fake-moltbot-assistant-drops-malware-peckbirdy-takes-flight-for-cross-platform-attacks/ Huge thanks to our episode sponsor, Conveyor Another security questionnaire hits your desk. Ever wish it could magically disappear? You already have the answers that customers should self-serve, but they can't find the info in your Trust Center. That's why Conveyor built the first truly agentic Trust Center. An AI Agent lives inside it, answering customer questions, sharing documents, and even completing full questionnaires instantly. Customers get what they need fast. it's magical, touchless, and extremely accurate....

US cyber chief uploaded sensitive files into public ChatGPT, Vibe-coded 'Sicarii' ransomware can't be decrypted, WhatsApp account feature combats spyware

US cyber chief uploaded sensitive files into public ChatGPT Vibe-coded 'Sicarii' ransomware can't be decrypted WhatsApp account feature combats spyware Check out the show notes here: https://cisoseries.com/cybersecurity-news-us-cyber-chief-uploaded-sensitive-files-into-public-chatgpt-vibe-coded-sicarii-ransomware-cant-be-decrypted-whatsapp-account-feature-combats-spyware/ Huge thanks to our episode sponsor, Conveyor Ever dream of giving customers instant answers to their security questions without ever filling out another questionnaire? Meet Conveyor's new Trust Center Agent. The Agent lives in your Conveyor Trust Center and answers every customer question, surfaces documents and even completes full questionnaires instantly so customers can finish their review and be on their way. Top tech companies like Atlassian, Zapier, and more are using Conveyor...

Microsoft patches Office zero-day vulnerability, Indian users targeted by Blackmoon, Konni targets blockchain developers

Microsoft patches Office zero-day vulnerability Indian users targeted by Blackmoon Konni targets blockchain developers Huge thanks to our episode sponsor, Conveyor True story, an infosec team had to give customers MapQuest style directions just to navigate their Trust Center. Spoiler: it didn't reduce follow-up questions and created even more work for everyone involved. With Conveyor's new Trust Center AI Agent, customers get answers instantly and can even upload questionnaires for the Agent to complete. This way, customers find what they need and keep moving, without your team needing to intervene.Learn more at conveyor.com

Department of Know: Davos worries, UK-China tensions, calendar concerns

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Krista Arndt, associate CISO, St. Luke's University Health Network, and Jason Shockey, CISO, Cenlar FSB Thanks to our show sponsor, Conveyor Ever dream of giving customers instant answers to their security questions without ever filling out another questionnaire? Meet Conveyor's new Trust Center Agent. The Agent lives in your Conveyor Trust Center and answers every customer question, surfaces documents and even completes full questionnaires instantly so customers can finish their review and be on their way. Top tech companies like Atlassian, Zapier, and more...

Microsoft Patch problems, Sandworm hits Poland, Dresden Museum cyberattack

Microsoft Outlook and boot problems Sandworm likely behind cyberattack on Poland's power grid Dresden museum network suffers cyberattack Huge thanks to our episode sponsor, Conveyor Ever wish your customers could magically get answers to their own security questionnaires before they ever hit your desk? We've heard this wish from hundreds of teams so Conveyor just launched a new Trust Center AI Agent. The Agent lives in your Conveyor hosted Trust Center and answers customer questions, surfaces documents and even completes full questionnaires instantly so customers can finish their review without your intervention. Join top tech companies using Conveyor today like...

Multi-stage SharePoint attack, SmarterMail bypass flaw, AI worries Davos

Multistage AiTM phishing and BEC campaign abusing SharePoint SmarterMail auth bypass flaw now exploited despite patch The problem of AI agents emerges at Davos Huge thanks to our sponsor, Dropzone AI All week we've talked about alert fatigue, MTTR, and the math that's breaking your SOC. Here's the proof. Dropzone AI is trusted by over 300 global enterprises and MSSPs. Named a Gartner Cool Vendor. Recognized in the Fortune Cyber 60. And backed by $37 million in Series B funding. But they're not stopping at a single agent. They're building toward fully agentic SOC teams where human engineers are augmented...

Tesla hacked at Pwn2Own Automotive, Everest sitting on Under Armour data? PurpleBravo fake jobs campaign targets IP addresses

Tesla hacked at Pwn2Own Automotive Everest sitting on Under Armour data? PurpleBravo fake jobs campaign targets IP addresses Huge thanks to our sponsor, Dropzone AI Quick tip for SOC leaders measuring MTTR. Stop optimizing the human. Optimize what the human has to do. Dropzone AI handles the investigation legwork autonomously. Correlating alerts, gathering evidence, documenting findings. Your analysts only engage when it actually matters. The results are investigations that took hours and now take under 10 minutes with much better accuracy of up to 30%. And analysts who can finally focus on real threats. Proven at over 300 enterprises who...

UK-China forum, Iranian TV hijacked, VoidLink made by AI

UK and China try to ease cyberattack tensions Iranian state TV hijacked VoidLink malware is AI-generated Huge thanks to our sponsor, Dropzone AI Remember yesterday's 2 AM alert? Here's how it ends differently with Dropzone AI. The alert fires. Within minutes, not hours, their AI SOC agents have already correlated logs across your entire security stack, built a complete evidence chain, and delivered a verdict. False positive, or escalate immediately. Your analyst wakes up to answers, not a queue. That's autonomous investigation at enterprise scale. Experience it for yourself at dropzone.ai.

Gemini prompt injection flaw exposes calendar info, hacker admits to Supreme Court data leak, researchers uncover PDFSIDER malware

Gemini prompt injection flaw exposes calendar info Hacker admits to leaking stolen Supreme Court data Researchers uncover PDFSIDER malware Huge thanks to our sponsor, Dropzone AI It's 2 AM. An alert fires. Possible data exfiltration. Your on-call analyst is three time zones away, half-asleep, context-switching between tools. By the time they piece together the evidence, forty-five minutes have passed. Was it a real threat or another false positive? The clock is ticking. Tomorrow, I'll tell you how 300 enterprises solved this exact problem. But if you can't wait, head over to dropzone.ai to learn more.

Department of Know: Easterly helms RSAC, Third party apps report, Self-poisoning AI

Link to episode page This week's Department of Know is hosted by Sarah Lane with guests Dmitriy Sokolovskiy, senior vice president, information security, Semrush, and Nick Espinosa, host, The Deep Dive Radio Show Thanks to our show sponsor, Dropzone AI How many alerts did your SOC investigate last week? How many sat in the queue untouched? If you don't know those numbers, or you don't like them, Dropzone AI can help. They've helped enterprises like UiPath and Zapier handle ten times more alerts without adding headcount. Their AI SOC agents work around the clock, investigating every alert autonomously. Book a...

NSA dual-hat question, third-party report, GhostPoster extension continues

Cybercom-NSA leadership nominee to assess dual-hat role Two-thirds of third-party applications access sensitive data without justification, says report GhostPoster browser extensions up to 840,000 installs Huge thanks to our sponsor, Dropzone AI Here's a security tip most vendors won't tell you. Your SOC analysts aren't slow. They're drowning. The average enterprise faces tens of thousands of alerts daily, and even your best analysts can only investigate so many before burnout wins. Dropzone AI changes that math. Their AI SOC agents autonomously investigate every alert, no playbooks or code required, in three to ten minutes flat. Stop triaging. Start defending. Book...

Easterly helms RSAC, Windows update problems, Police Copilot gaffe

Jen Easterly to helm RSAC Windows January update causes login problems UK police blame Copilot for intelligence mistake Thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com. Find the stories behind the headlines at CISOseries.com.

U.S. weighs cyberwarfare options, DeadLock uses smart contracts to hide work, China says stop using US and Israeli cybersecurity software

U.S. weighs private companies' cyberwarfare roles China: stop using US and Israeli cybersecurity software DeadLock uses smart contracts to hide work Thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com.

GoBruteforcer targets blockchain projects, Android bug causes volume key issues, Verizon to stop automatic phone unlocks

GoBruteforcer targets blockchain projects Android accessibility issue just a bug Verizon to stop automatic phone unlocks Thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com.

Instagram denies breach, Sweden detains spying suspect, n8n attack steals OAuth tokens

Instagram denies breach post-data leak Sweden detains consultant suspected of spying n8n supply chain attack steals OAuth tokens Thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com.

Department of Know: Brightspeed investigates breach, Prompt injection woes

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Johna Till Johnson, CEO and Founder, Nemertes (check out the Nemertes substack) and Jason Shockey, CISO, Cenlar FSB. Jason will be speaking at MBA Servicing Solution26 in Texas in late February. Details here. Thanks to our show sponsor, ThreatLocker Want real Zero Trust training?Zero Trust World 2026delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with...

BreachForums database leaked, Instagram breach worries, UK government exempts self

BreachForums hacking forum database leaked exposing 324,000 accounts Instagram breach exposes user data, creates password reset panic UK government exempts self from flagship cyber law Thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com. Find the stories behind the headlines at CISOseries.com.

Microsoft enforces admin MFA, Cisco patches ISE, Illinois breaches self

Microsoft to enforce MFA for Microsoft 365 admin center sign-ins Cisco patches ISE security vulnerability after PoC release Illinois state agency breaches itself Huge thanks to our sponsor, Hoxhunt A small tip for CISOs: if you're unsure whether your security training is actually reducing phishing risk, check out what Qualcomm achieved with Hoxhunt. They took their 1,000 highest-risk users from consistent under-performers to outperforming the rest of the company, driving measurable human risk reduction and earning a CSO50 Award. See the Qualcomm case athoxhunt.com/qualcomm Find the stories behind the headlines at CISOseries.com.

ESA confirms new data heist, Ni8mare lets hackers hijack n8n servers, Taiwan blames 'cyber army' for intrusion attempts

ESA confirms new data heist Ni8mare lets hackers hijack n8n servers Taiwan blames 'cyber army' for intrusion attempts Huge thanks to our sponsor, Hoxhunt Traditional security training fails because it treats employees like the problem. Hoxhunt treats them like the solution. AI-powered simulations mirror actual attacks hitting your inbox. Instant coaching turns mistakes into learning moments. Gamified rewards make security engaging. The result? Real behavior change that measurably reduces your risk. Thousands of companies trust Hoxhunt to transform human vulnerability into human defense. Visit hoxhunt.com/cisoseries to learn more.

UK cyber reset, no MFA is a problem, US cyberattacks on display

The UK hits reset on cybersecurity No MFA, Know Problems US may have coordinated cyberattacks with Maduro's arrest Huge thanks to our sponsor, Hoxhunt A small tip for CISOs: if you're unsure whether your security training is actually reducing phishing risk, check out what Qualcomm achieved with Hoxhunt. They took their 1,000 highest-risk users from consistent under-performers to outperforming the rest of the company, driving measurable human risk reduction and earning a CSO50 Award. See the Qualcomm case athoxhunt.com/qualcomm

European hospitality blue screen of death, Brightspeed investigates breach, Convicted Bitfinex launderer freed

European hospitality blue screen of death Brightspeed investigates breach Convicted Bitfinex launderer freed Huge thanks to our sponsor, Hoxhunt Traditional security training fails because it treats employees like the problem. Hoxhunt treats them like the solution. AI-powered simulations mirror actual attacks hitting your inbox. Instant coaching turns mistakes into learning moments. Gamified rewards make security engaging. The result? Real behavior change that measurably reduces your risk. Thousands of companies trust Hoxhunt to transform human vulnerability into human defense. Visit hoxhunt.com/cisoseries to learn more.

Department of Know: Sedgewick confirms incident, Coupang store credit only, AI needs generators

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Peter Clay, CISO, Aireon, and Chris Ray, Field CTO, GigaOm Thanks to our show sponsor, HoxHunt A small tip for CISOs: if you're unsure whether your security training is actually reducing phishing risk, check out what Qualcomm achieved with Hoxhunt. They took their 1,000 highest-risk users from consistent under-performers to outperforming the rest of the company, driving measurable human risk reduction and earning a CSO50 Award. See the Qualcomm case at hoxhunt.com/qualcomm All links and the video of this episode can be found on...

Palo Alto AI warning, Resecurity hack fiasco, Christmas ColdFusion attack

Palo Alto Networks boss calls AI agents biggest insider threat Hackers claim Resecurity hack, firm says it was a honeypot Thousands of ColdFusion exploit attempts spotted during Christmas holiday Huge thanks to our sponsor, Hoxhunt A small tip for CISOs: if you're unsure whether your security training is actually reducing phishing risk, check out what Qualcomm achieved with Hoxhunt. They took their 1,000 highest-risk users from consistent under-performers to outperforming the rest of the company, driving measurable human risk reduction and earning a CSO50 Award. See the Qualcomm case athoxhunt.com/qualcomm Find the stories behind the headlines at CISOseries.com.

NYC Inauguration bans Flipper Zero, UK taxes crypto, Finland seizes ship

NYC mayoral inauguration bans Flipper Zero and Raspberry Pi devices Crypto must now share account details with UK tax officials Finland seizes suspected cable sabotage ship Huge thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 atztw.com. Find the stories behind the headlines at CISOseries.com.

Unleash Protocol hackers drain millions, DarkSpectre campaigns exposed, Shai-Hulud attack led Trust Wallet heist

Hackers drain millions from Unleash Protocol DarkSpectre campaigns exposed Shai-Hulud attack led Trust Wallet heist Huge thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 atztw.com.

Silver Fox targets Indian users, Mustang Panda deploys ToneShell, will prompt injection ever be 'solved'?

Silver Fox targets Indian users Mustang Panda deploys ToneShell Will prompt injection ever be 'solved'? Huge thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 atztw.com.

Coupang recovers laptop in river, Trust Wallet reports 2k+ wallets drained, Sax discloses 2024 data breach

Coupang recovers laptop allegedly thrown into river Trust Wallet reports 2k+ wallets drained Sax discloses 2024 data breach Huge thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 atztw.com.

The Department of Know: year in review and predictions

Link to episode page To end off a tumultuous year, our final Department of Know episode of 2025 features a chat between hostRich Stroffolino and producer Steve Prentice. Join them as they chat about the biggest stories of 2025, the trends we are seeing, and what we can expect in the new year. Thanks to our show sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on...

Rainbow Six Siege breach, backup generators for AI, LastPass reverberations

Rainbow Six Siege suffers breach, gamers go shopping Diesel generators and aircraft engines in high demand to power AI LastPass 2022 breach reverberates through crypto world Huge thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com. Find the stories behind the headlines at CISOseries.com.

Fortinet VPN exploit, Google gmail change, Aflac breach update

Active exploitation of Fortinet VPN bypass utility observed Google possibly allowing users to change default gmail address June Aflac attack resulted in data theft Thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com. Find the stories behind the headlines at CISOseries.com

Scams target MENA region, pen testers accused of blackmail, DDoS protection faces fresh challenges

Coordinated scams target MENA region Pen Test Partners accused of 'blackmail' Hackers steal record $2.7B in crypto in 2025 Thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com.

ServiceNow to acquire cybersecurity startup Armis, MacSync Stealer adopts quieter installation, Nissan customer data stolen in Red Hat raid

ServiceNow to acquire cybersecurity startup Armis MacSync Stealer adopts quieter installation Nissan customer data stolen in Red Hat raid Thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com.

Spotify music library scraped, DDoS disrupts French postal services, Fake delivery sites hit holiday shoppers

Spotify music library scraped DDoS disrupts France's postal and banking services Fake delivery websites hit holiday shoppers Thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com.

Department of Know: President signs defense bill, time flies at NIST, Italian ferry malware

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Jason Taule, CISO, Luminis Health, and Chris Ray, Field CTO, GigaOm Thanks to our show sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com. All links and the video of this episode can be found on CISO Series.com

President's cyber bill, Iranian APT resurfaces, Kimwold DDoS attack

President signs defense bill funding Cyber Command, Pentagon phone security Iranian APT Infy resurfaces with new malware Massive Android botnet Kimwolf launches DDoS attack Thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 46 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com. Find the stories behind the headlines at CISOseries.com.

Windows RemoteApp problems, ferry malware arrest, Senator's open-source warning

Recent Windows updates break RemoteApp connections France arrests threat actors for installing malware on Italian ferry Senate Intel chair urges safeguard against open-source software threats Huge thanks to our sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. Security training fails when it's generic. Adaptive's platform personalizes training and runs deepfake simulations across email, SMS, voice, and video. And with Adaptive's AI Content Creator, you can drop in a breaking threat or compliance doc and instantly turn it into interactive, multilingual training no designers, no delays. Learn more at adaptivesecurity.com....

FTC orders crypto to pay, New exploit of React2Shell, Ukraine fraud ring take down

FTC orders crypto to pay New exploit of React2Shell Ukraine-based fraud ring taken down Huge thanks to our sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. In deepfake scams, the tells aren't glitchy video anymore it's behavior: "Do this right now," or "keep it secret." If you hear urgency and secrecy together, stop and verify through a second channel. Call a known number, start a chat thread, or ask something only the real person would know. Adaptive trains teams against exactly these tactics. Learn more at adaptivesecurity.com.

Rogue NuGet package steals data, Venezuela's PDVSA suffers attack, patched Fortinet flaws exploited

Rogue NuGet package steals data Venezuela's PDVSA suffers attack Patched Fortinet flaws exploited Huge thanks to our sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. Picture a "new hire" who interviews well except they're synthetic: AI video, AI voice, AI backstory. Once they're in, they go after payroll, internal docs, and access. That's the new reality: the attack surface is trust itself. Adaptive fights back with realistic deepfake simulations and training that actually sticks. Learn more at adaptivesecurity.com.

US taps private firms in cyber offensive, Microsoft updates cause queuing failures, phishing campaign delivers Phantom Stealer

US turns to private firms in cyber offensive Microsoft updates cause queuing failures Phishing campaign delivers Phantom stealer Huge thanks to our sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. Attackers don't need malware anymore; they need trust. Tip: set a simple passphrase for high-risk actions, like wire requests or "urgent" account recovery especially within finance teams and families. If the caller can't answer it, pause and verify. Adaptive runs deepfake and vishing simulations so employees practice this before it's real. Learn more at adaptivesecurity.com.

Department of Know: MITRE's weaknesses list, DoD goes postquantum, Coupang fallout

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Andy Ellis, Principal, Duha, and Johna Till Johnson, CEO and Founder, Nemertes Research Thanks to our show sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. AI is rewriting the cybersecurity rulebook, because attackers can now scale persuasion as easily as they scale code. The real target isn't just your systems anymore; it's human trust. If you aren't actively testing your organization against AI-driven phishing, vishing, and deepfakes, you're leaving a gap criminals will...

MongoDB records exposed, Apple WebKit patches, Coupang culprit identified

16TB MongoDB database exposes nearly 4.3 billion professional records Apple posts updates after discovery of WebKit flaws Coupang data breach traced to ex-employee Huge thanks to our sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. Deepfakes aren't science fiction anymore; they're a daily threat. Quick tip: if your voicemail greeting is your real voice, switch it to the default robot voice. A few seconds of audio can be enough to clone you. Adaptive helps teams spot and stop these AI-powered social engineering attacks. Learn more at adaptivesecurity.com. Find the...

'DroidLock' demands ransom, Google fixes secret Chrome 0-day, UK fines LastPass over 2022 breach

'DroidLock' malware demands ransom Google fixes secret Chrome 0-day UK fines LastPass over 2022 breach Huge thanks to our episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. Security training fails when it's generic. Adaptive's platform personalizes training and runs deepfake simulations across email, SMS, voice, and video. And with Adaptive's AI Content Creator, you can drop in a breaking threat or compliance doc and instantly turn it into interactive, multilingual training no designers, no delays. Learn more at adaptivesecurity.com.

Coupang CEO resigns, hactivists target US infrastructure, Israeli cybersecurity hits record funding

CEO of retail giant Coupang resigns Pro-Russia hactivists target US infrastructure Israeli cybersecurity funding hits record Huge thanks to our episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. In deepfake scams, the tells aren't glitchy video anymore it's behavior: "Do this right now," or "keep it secret." If you hear urgency and secrecy together, stop and verify through a second channel. Call a known number, start a chat thread, or ask something only the real person would know. Adaptive trains teams against exactly these tactics. adaptivesecurity.com.

Spain arrest over data records, goodbye dark Telegram, scammers poison AI search results

Spain arrest over data records Goodbye, dark Telegram Scammers poison AI search results Huge thanks to our episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. Picture a "new hire" who interviews well except they're synthetic: AI video, AI voice, AI backstory. Once they're in, they go after payroll, internal docs, and access. That's the new reality: the attack surface is trust itself. Adaptive fights back with realistic deepfake simulations and training that actually sticks. adaptivesecurity.com.

Ransomware costs billions, cybercrime leads to real violence, three arrested for hacking tools

Ransomware payments pass $4.5 billion Cybercrime networks orchestrate real-world violence Three arrested over possessing hacking tools Huge thanks to our episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. Attackers don't need malware anymore; they need trust. Tip: set a simple passphrase for high-risk actions, like wire requests or "urgent" account recovery especially within finance teams and families. If the caller can't answer it, pause and verify. Adaptive runs deepfake and vishing simulations so employees practice this before it's real. adaptivesecurity.com.

Department of Know: CISO hiring warning, critical threat actor law, Microsoft Defender outage

Link to episode page This week's Department of Know is hosted by Sarah Lane with guests Jason Shockey, CISO, Cenlar FSB, and Mike Lockhart, CISO, Eagleview Thanks to our show sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. AI is rewriting the cybersecurity rulebook, because attackers can now scale persuasion as easily as they scale code. The real target isn't just your systems anymore; it's human trust. If you aren't actively testing your organization against AI-driven phishing, vishing, and deepfakes, you're leaving a gap criminals will exploit. Adaptive runs...

Palo Alto VPN attacks, NATO cyberdefense exercise, Chinese exploit React2Shell

New wave of VPN login attempts on Palo Alto portals NATO holds its largest-ever cyberdefense exercise Chinese hackers exploiting React2Shell bug Huge thanks to our episode sponsor, Adaptive Security This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. Deepfakes aren't science fiction anymore; they're a daily threat. Quick tip: if your voicemail greeting is your real voice, switch it to the default robot voice. A few seconds of audio can be enough to clone you. Adaptive helps teams spot and stop these AI-powered social engineering attacks. Learn more at adaptivesecurity.com. Find the stories...

Predator spyware, Russia blocks FaceTime, US cyber strategy coming

Predator spyware spotted across several countries Russia blocks FaceTime Draft US cyber strategy set for January release Huge thanks to our episode sponsor, Vanta This message comes from Vanta. What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. Get started at Vanta.com/CISO

Record-breaking DDoS attack, React bug puts servers at risk, RansomHouse attack

Record-breaking DDoS attack React bug puts servers at risk RansomHouse attack Huge thanks to our episode sponsor, Vanta This message comes from Vanta. What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. Get started at Vanta.com/CISO

Microsoft Defender outage disrupts threats, Apple resists India's app order, MuddyWater strikes Israel

Microsoft Defender outage disrupts threats Apple resists India's state-run app order MuddyWater strikes Israel with MuddyViper Huge thanks to our episode sponsor, Vanta This message comes from Vanta. What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. Get started at Vanta.com/CISO

India orders web safety app, arrests over IP camera snooping, Albiriox shows up on dark web

India orders web safety app Arrests over IP camera snooping Albiriox shows up on dark web Huge thanks to our episode sponsor, Vanta This message comes from Vanta. What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. Get started at Vanta.com/CISO

Department of Know: Prompt injection problems, California browser law, Hacklore's security myths

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Mathew Biby, director, cybersecurity, TixTrack, and Derek Fisher, Director of the Cyber Defense and Information Assurance Program, Temple University Thanks to our show sponsor, Vanta This message comes from Vanta. What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and...

Asahi ransomware details, California browser law, Windows Teams accelerated

Japanese brewer Asahi provides details regarding October ransomware attack California law regulating web browsers might impact national data privacy Microsoft to speed up Teams Huge thanks to our episode sponsor, Vanta This message comes from Vanta. What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. Get started at Vanta.com/CISO Find...

Microsoft blocks Entra, AI scammer legislation, ASUS patches AiCloud

Microsoft to block unauthorized scripts in Entra ID logins with 2026 CSP update New legislation targets scammers that use AI to deceive ASUS firmware patches critical AiCloud vulnerability Huge thanks to our episode sponsor, KnowBe4 Cybersecurity isn't just a tech problemit's a human one. That's why KnowBe4's Human Risk Management platform allows you to measure, quantify and actuallyreduce human risk across your organization. With AI-powered risk scoring, automated coaching and reporting, HRM+ helps you surface your highest risk users and reduce the risk of data breaches and cyberattacks proactively. Ready to move from awareness to action? Request a demo of...

AWS outage botnet smacks 28 countries, LLMs help malware authors evade detection, Anthropic pressed over Claude espionage

AWS outage botnet smacks 28 countries LLMs help malware authors evade detection Anthropic questioned over Claude espionage Huge thanks to our episode sponsor, KnowBe4 Cybersecurity isn't just a tech problemit's a human one. That's why KnowBe4's Human Risk Management platform allows you to measure, quantify and actuallyreduce human risk across your organization. With AI-powered risk scoring, automated coaching and reporting, HRM+ helps you surface your highest risk users and reduce the risk of data breaches and cyberattacks proactively. Ready to move from awareness to action? Request a demo of HRM+ today at knowbe4.com.

CISA warns of app break-ins, StealC V2 spread through blender files, Russian entrepreneur arrested for treason

CISA warns of app break-ins StealC V2 spread through blender files Russia arrests cybersecurity entrepreneur for treason Huge thanks to our episode sponsor, KnowBe4 Cybersecurity isn't just a tech problemit's a human one. That's why KnowBe4's Human Risk Management platform allows you to measure, quantify and actuallyreduce human risk across your organization. With AI-powered risk scoring, automated coaching and reporting, HRM+ helps you surface your highest risk users and reduce the risk of data breaches and cyberattacks proactively. Ready to move from awareness to action? Request a demo of HRM+ today at knowbe4.com.

CISA orders feds to patch OIM, Delta Dental incurs breach, Ukraine postal operator systems down

CISA orders feds to patch OIM Delta Dental of Virginia incurs data breach Systems down at postal operator in Ukraine Huge thanks to our episode sponsor, KnowBe4 Cybersecurity isn't just a tech problemit's a human one. That's why KnowBe4's Human Risk Management platform allows you to measure, quantify and actuallyreduce human risk across your organization. With AI-powered risk scoring, automated coaching and reporting, HRM+ helps you surface your highest risk users and reduce the risk of data breaches and cyberattacks proactively. Ready to move from awareness to action? Request a demo of HRM+ today at knowbe4.com.

Department of Know: Overconfidence new zero-day, FCC torches Salt Typhoon rules, AI uninsurable

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Keith Townsend, Keith Townsend, host CTO Advisor Podcast, founder of The Advisor Bench, and creator of the Virtual CTO Advisor; and Howard Holton, CEO, GigaOm Thanks to our show sponsor, Knowbe4 Cybersecurity isn't just a tech problemit's a human one. That's why KnowBe4's Human Risk Management platform allows you to measure, quantify and actuallyreduce human risk across your organization. With AI-powered risk scoring, automated coaching and reporting, HRM+ helps you surface your highest risk users and reduce the risk of data breaches and cyberattacks...

CrowdStrike insider catch, Spanish airline breach, AI not insurable

CrowdStrike catches insider feeding information to hackers Spanish airline Iberia suffers breach and data leak AI is too risky to insure, say insurers Huge thanks to our episode sponsor, KnowBe4 Cybersecurity isn't just a tech problemit's a human one. That's why KnowBe4's Human Risk Management platform allows you to measure, quantify and actuallyreduce human risk across your organization. With AI-powered risk scoring, automated coaching and reporting, HRM+ helps you surface your highest risk users and reduce the risk of data breaches and cyberattacks proactively. Ready to move from awareness to action? Request a demo of HRM+ today at knowbe4.com. Find...

Sturnus captures encrypted chats, PowerSchool schools blamed, SEC security bill

Sturnus Android Trojan captures encrypted chats and hijacks devices Canadian regulators say schools share blame for PowerSchool hack Bill reintroduced to bolster cybersecurity at Securities and Exchange Commission Huge thanks to our episode sponsor, KnowBe4 Your email gateway isn't catching everything and cybercriminals know it. That's why there's KnowBe4's Cloud Email Security platform. It's not just another filterit's a dynamic, AI-powered layer of defense that detects and stops advanced threats before they reach your users' inbox. Request a demo of KnowBe4's Cloud Email Security at knowbe4.com or visit them this week at Microsoft Ignite booth #5523. Find the stories behind...

Cloudflare blames database, Crypto heist takedown, WhatsApp flaw exposed billions

Cloudflare blames database Crypto heist takedown WhatsApp flaw exposed billions Huge thanks to our episode sponsor, KnowBe4 Your email gateway isn't catching everything and cybercriminals know it. That's why there's KnowBe4's Cloud Email Security platform. It's not just another filterit's a dynamic, AI-powered layer of defense that detects and stops advanced threats before they reach your users' inbox. Request a demo of KnowBe4's Cloud Email Security at knowbe4.com or visit them this week at Microsoft Ignite booth #5523.

FCC to torch Salt Typhoon rules, Group claims Danish party website hits, MI5 warns Chinese spies are on LinkedIn

FCC to torch rules from Salt Typhoon Group claims hits on Danish party websites MI5 warns Chinese spies are using LinkedIn Huge thanks to our episode sponsor, KnowBe4 Your email gateway isn't catching everything and cybercriminals know it. That's why there's KnowBe4's Cloud Email Security platform. It's not just another filterit's a dynamic, AI-powered layer of defense that detects and stops advanced threats before they reach your users' inbox. Request a demo of KnowBe4's Cloud Email Security at knowbe4.com or visit them this week at Microsoft Ignite booth #5523.

Azure hit by DDoS, Kenyan government sites recover, EVALUSION emerges

Azure hit by DDoS using 500K IPs Kenyan government websites back online EVALUSION emerges Huge thanks to our episode sponsor, KnowBe4 Your email gateway isn't catching everything and cybercriminals know it. That's why there's KnowBe4's Cloud Email Security platform. It's not just another filterit's a dynamic, AI-powered layer of defense that detects and stops advanced threats before they reach your users' inbox. Request a demo of KnowBe4's Cloud Email Security at knowbe4.com or visit them this week at Microsoft Ignite booth #5523.

Department of Know: Autonomous AI cyberattack, CISOs back to work, bus kill switches

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Robb Dunewood, Host, Daily Tech News Show, and Howard Holton, CEO, GigaOm Thanks to our show sponsor, KnowBe4 Your email gateway isn't catching everything and cybercriminals know it. That's why there's KnowBe4's Cloud Email Security platform. It's not just another filterit's a dynamic, AI-powered layer of defense that detects and stops advanced threats before they reach your users' inbox. Request a demo of KnowBe4's Cloud Email Security at knowbe4.com or visit them this week at Microsoft Ignite booth #5523. All links and the video...

Windows 10 update failure, autonomous AI cyberattack, Feds fumble Cisco patches

Microsoft warns of potential Windows 10 update failure China-backed hackers launch first large-scale autonomous AI cyberattack Feds fumbled Cisco patches requirements, says CISA Huge thanks to our episode sponsor, KnowBe4 Your email gateway isn't catching everything and cybercriminals know it. That's why there's KnowBe4's Cloud Email Security platform. It's not just another filterit's a dynamic, AI-powered layer of defense that detects and stops advanced threats before they reach your users' inbox. Request a demo of KnowBe4's Cloud Email Security at knowbe4.com or visit them this week at Microsoft Ignite booth #5523. Find the stories behind the headlines at CISOseries.com.

Cyber laws reprieved, Microsoft screen capture, FBI highlights Akira

Two key cyber laws are back as president signs bill to end shutdown Microsoft's screen capture prevention for Teams users is finally rolling out FBI calls Akira top five ransomware variant out of 130 targeting U.S. businesses Huge thanks to our sponsor, Vanta What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" ....or the really scary one: "how do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling...

Mobile blackout for Russian travelers, Windows 11 supports 3rd party passkeys, Synology patches BeeStation flaw

Mobile internet blackout for Russian travelers Windows 11 supports 3rd-party passkey apps Synology patches BeeStation flaw Huge thanks to our sponsor, Vanta What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" ....or the really scary one: "how do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. Vanta...

Google's remote-wipe weapon, Qilin ransomware activity surges, GootLoader is back

Google's Find Hub turns into remote-wipe weapon Qilin ransomware activity surges GootLoader is back Huge thanks to our sponsor, Vanta What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" ....or the really scary one: "how do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. Vanta also fits...

Reauthorizing CISA, Electric bus kill switches, GDPR for AI

CISA reauthorization Denmark and Norway investigating electric bus "kill switches" European Commission looking to simplify privacy laws for AI Huge thanks to our sponsor, Vanta What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" ....or the really scary one: "how do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security...

Department of Know: Cybercriminals join forces, SleepyDuck" exploits Ethereum, passwords still awful

Link to episode page This week's Department of Know is hosted byRich Stroffolinowith guestsJacob Coombs, CISO,Tandem Diabetes Care, andRoss Young, Co-host,CISO Tradecraft Thanks to our show sponsor, Vanta What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" .or the really scary one: "how do I get out from under these old tools and manual processes? EnterVanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies...

runC Docker threats, lost iPhone scam, Landfall spyware warning

runC flaws could allow hackers to escape Docker containers Lost iPhone scam warning Landfall Android spyware targets Samsung Galaxy phones Huge thanks to our sponsor, Vanta What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" ....or the really scary one: "how do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your...

Hackers use Hyper-V, Cisco UCCX flaw, The Louvre's password

Hackers use Windows Hyper-V to evade EDR detection Critical Cisco UCCX flaw lets attackers run commands as root The Louvre's video security password was reportedly Louvre Huge thanks to our sponsor, ThreatLocker Imagine having the power to decide exactly what runs in your IT environment and blocking everything else by default. That's what ThreatLocker delivers. As a zero-trust endpoint protection platform, ThreatLocker fills the gaps traditional solutions leave behind, giving your business stronger security and control. Don't just react to threats stop them with ThreatLocker. Find the stories behind the headlines at CISOseries.com.

Google uncovers PROMPFLUX, CISA warns of CentOS Web Panel bug, Threat group targets academics

Google uncovers PROMPTFLUX malware CISA warns of CentOS Web Panel bug Threat group targets academics Huge thanks to our sponsor, ThreatLocker Cybercriminals don't knock they sneak in through the cracks other tools miss. That's why organizations are turning to ThreatLocker. As a zero-trust endpoint protection platform, ThreatLocker puts you back in control, blocking what doesn't belong and stopping attacks before they spread. Zero Trust security starts here with ThreatLocker

Scattered Spider, LAPSUS$, ShinyHunters join forces, Nikkei data breach impacts 17k people, React Native NPM flaw leads to attacks

Scattered Spider, LAPSUS$, and ShinyHunters join forces Nikkei reports data breach impacting 17,000 people React Native NPM flaw leads to attacks Huge thanks to our sponsor, ThreatLocker Imagine having the power to decide exactly what runs in your IT environment and blocking everything else by default. That's what ThreatLocker delivers. As a zero-trust endpoint protection platform, ThreatLocker fills the gaps traditional solutions leave behind, giving your business stronger security and control. Don't just react to threats stop them with ThreatLocker.

"SleepyDuck" uses Ethereum, SesameOp abuses OpenAI API, cybercrooks steal physical cargo

"SleepyDuck" uses Ethereum to keep command server alive SesameOp abuses OpenAI Assistants API Organized crime cybercrooks steal cargo Huge thanks to our sponsor, ThreatLocker Cybercriminals don't knock they sneak in through the cracks other tools miss. That's why organizations are turning to ThreatLocker. As a zero-trust endpoint protection platform, ThreatLocker puts you back in control, blocking what doesn't belong and stopping attacks before they spread. Zero Trust security starts here with ThreatLocker

Department of Know: Azure security pitfalls, retailer cyberattack profits, Aardvark eats bugs

Link to episode page This week's Department of Know is hosted by Rich Stroffolino with guests Davi Ottenheimer, vp, digital trust and ethics, Inrupt, and Rob Teel, Field CTO, GigaOm Thanks to our show sponsor, ThreatLocker Imagine having the power to decide exactly what runs in your IT environment and blocking everything else by default. That's what ThreatLocker delivers. As a zero-trust endpoint protection platform, ThreatLocker fills the gaps traditional solutions leave behind, giving your business stronger security and control. Don't just react to threats stop them with ThreatLocker. All links and the video of this episode can be found...

Australia BadCandy warning, Cisco firewall attack, Aardvark eats bugs

Australia warns of BADCANDY attacks exploiting Cisco IOS XE Chinese hackers exploiting Cisco ASA firewalls used by governments worldwide OpenAI's Aardvark GPT-5 agent finds and fixes code flaws automatically Huge thanks to our sponsor, ThreatLocker Imagine having the power to decide exactly what runs in your IT environment and blocking everything else by default. That's what ThreatLocker delivers. As a zero-trust endpoint protection platform, ThreatLocker fills the gaps traditional solutions leave behind, giving your business stronger security and control. Don't just react to threats stop them with ThreatLocker. Find the stories behind the headlines at CISOseries.com.

LinkedIn AI opt-out, NSA leadership candidates, Python foundation withdraws

LinkedIn users have until Monday to opt out of its AI training program New names surface for NSA leadership Open-source security group pulls out of U.S. grant, citing DEI restrictions Huge thanks to our sponsor, Conveyor Security reviews don't have to feel like a hurricane. Most teams are buried in back-and-forth emails and never-ending customer requests for documentation or answers. But Conveyor takes all that chaos and turns it into calm. AI fills in the questionnaires, your trust center is always ready, and sales cycles move without stalls. Breathe easiercheck out Conveyor at www.conveyor.com. Find the stories behind the headlines...

LG Uplus confirms breach, Conduent attack impacts 10M+, hackers exploit tools against Ukraine

LG Uplus confirms cybersecurity incident 10 million+ impacted by Conduent breach Russian hackers exploit tools against Ukrainian targets Huge thanks to our sponsor, Conveyor Security reviews don't have to feel like a hurricane. Most teams are buried in back-and-forth emails and never-ending customer requests for documentation or answers. But Conveyor takes all that chaos and turns it into calm. AI fills in the questionnaires, your trust center is always ready, and sales cycles move without stalls. Breathe easiercheck out Conveyor at www.conveyor.com.

Android malware types like a human, sanctions weaken cyber ecosystems, side-channel extracts Intel, AMD secrets

New Android malware types like a human Sanctions weaken nation-state cyber ecosystems Side-channel attack extracts Intel, AMD secrets Huge thanks to our sponsor, Conveyor Have you been personally victimized by a questionnaire this week? The queue never ends. But Conveyor can change that story. With AI that answers questionnaires of any format, and a trust center that handles document sharing, security reviews get done without the stress. Feel calm in the chaos with Conveyor. Learn more at www.conveyor.com.

Atlas browser hijacked, Bye, bye Twitter birdie, Dante spyware surfaces

Atlas browser hijacked Bye, bye Twitter birdie Dante spyware surfaces Huge thanks to our sponsor, Conveyor Security reviews don't have to feel like a hurricane. Most teams are buried in back-and-forth emails and never-ending customer requests for documentation or answers. But Conveyor takes all that chaos and turns it into calm. AI fills in the questionnaires, your trust center is always ready, and sales cycles move without stalls. Breathe easiercheck out Conveyor at www.conveyor.com.

Department of Know: Promoting passphrases, questioning international security conferences, gift card hackers

Link to episode page This week's edition of The Department of Knowis hosted by Rich Stroffolino with guests Bil Harmer, operating partner and CISO, Craft Ventures, and Sasha Pereira, CISO, WASH Thanks to our show sponsor, ThreatLocker If security questionnaires make you feel like you're drowning in chaos, you're not alone. Endless spreadsheets, portals, and questionsalways when you least expect them. Conveyor brings calm to the storm. With AI that auto-fills questionnaires and a trust center that shares all your docs in one place, you'll feel peace where there used to be panic. Find your security review zen at www.conveyor.com....

Microsoft WSUS vulnerability, LastPass death hoax, Copilot phishing technique

Microsoft WSUS vulnerability could allow for remote code execution Fake LastPass death claims used to breach password vaults New CoPhish attack steals OAuth tokens via Copilot Studio agents Huge thanks to our sponsor, Conveyor If security questionnaires make you feel like you're drowning in chaos, you're not alone. Endless spreadsheets, portals, and questionsalways when you least expect them. Conveyor brings calm to the storm. With AI that auto-fills questionnaires and a trust center that shares all your docs in one place, you'll feel peace where there used to be panic. Find your security review zen at www.conveyor.com. Find the stories...

Week in Review: AI powered cyberattacks, Chinese time hacked, the 72 hour workweek

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guests David Cross, CISO, Atlassian, and davidcrosstravels.com, and Montez Fitzpatrick, CISO, Navvis Thanks to our show sponsor, ThreatLocker Imagine having the power to decide exactly what runs in your IT environment and blocking everything else by default. That's what ThreatLocker delivers. As a zero-trust endpoint protection platform, ThreatLocker fills the gaps traditional solutions leave behind, giving your business stronger security and control. Don't just react to threats stop them with ThreatLocker. All links and the video of this episode can be found...

Jingle Thief exploit, Lazarus targets jobseekers, the 72 hour workweek

Jingle Thief hackers steal millions in gift cards by exploiting cloud infrastructure Lazarus hackers targeted European defense companies Deep Tech work culture pushes for 72 hour workweeks Huge thanks to our sponsor, ThreatLocker Imagine having the power to decide exactly what runs in your IT environment and blocking everything else by default. That's what ThreatLocker delivers. As a zero-trust endpoint protection platform, ThreatLocker fills the gaps traditional solutions leave behind, giving your business stronger security and control. Don't just react to threats stop them with ThreatLocker. Find the stories behind the headlines at CISOseries.com.

TP-Link urges updates, MuddyWater espionage campaign, flaw hits Adobe Commerce

TP-Link urges updates for Omada gateways MuddyWater targets organizations in espionage campaign "SessionReaper" flaw exploited in Adobe Commerce Huge thanks to our sponsor, ThreatLocker Cybercriminals don't knock they sneak in through the cracks other tools miss. That's why organizations are turning to ThreatLocker. As a zero-trust endpoint protection platform, ThreatLocker puts you back in control, blocking what doesn't belong and stopping attacks before they spread. Zero Trust security starts here with ThreatLocker

Russian hackers replace malware with new tools, Windows updates cause login issues, campaign targets high-profile servers

Russian state hackers replace burned malware with new tools Recent Windows updates cause login issues on some PCs Sophisticated campaign targets servers of high-profile organizations Huge thanks to our sponsor, ThreatLocker Imagine having the power to decide exactly what runs in your IT environment and blocking everything else by default. That's what ThreatLocker delivers. As a zero-trust endpoint protection platform, ThreatLocker fills the gaps traditional solutions leave behind, giving your business stronger security and control. Don't just react to threats stop them with ThreatLocker.

AWS outage, NSA hacking accusations, High risk WhatsApp automation

DNS failure leads to AWS outage China accuses NSA of hacking national time center Chrome store flooded with high-risk WhatsApp automation Huge thanks to our sponsor, ThreatLocker Cybercriminals don't knock they sneak in through the cracks other tools miss. That's why organizations are turning to ThreatLocker. As a zero-trust endpoint protection platform, ThreatLocker puts you back in control, blocking what doesn't belong and stopping attacks before they spread. Zero Trust security starts here with ThreatLocker

Europol dismantles SIM farm, Envoy Air compromised, Everest claims Collins hack

Europol dismantles 49 million fake account SIM farm Envoy Air confirms Oracle E-Business Suite compromise Cybercrime group Everest claims Collins Aerospace hack Huge thanks to our sponsor, ThreatLocker Imagine having the power to decide exactly what runs in your IT environment and blocking everything else by default. That's what ThreatLocker delivers. As a zero-trust endpoint protection platform, ThreatLocker fills the gaps traditional solutions leave behind, giving your business stronger security and control. Don't just react to threats stop them with ThreatLocker. Find the stories behind the headlines at CISOseries.com.

Week in Review: Velociraptor pushes LockBit, Hartman loses nomination, Sotheby's cyberattack

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guests Tom Hollingsworth, networking technology advisor, The Futurum Group, as well as on BlueSky, and Brett Conlon, CISO, American Century Investments Thanks to our show sponsor, Vanta What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" .or the really scary one: "how do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence,...

Sotheby's suffers cyberattack, Cisco "Zero Disco' attacks, Microsoft revokes ransomware certificates

Sotheby's suffers cyberattack Hackers exploit Cisco SNMP flaw in "Zero Disco' attacks Microsoft revokes more than 200 certificates to disrupt ransomware campaign Huge thanks to our sponsor, Vanta What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" ....or the really scary one: "how do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and...

MANGO discloses data breach, Jewelbug infiltrates Russian IT network, nation-state behind F5 attack?

MANGO discloses data breach Threat group 'Jewelbug' infiltrates Russian IT network F5 discloses breach tied to nation-state threat actor Huge thanks to our sponsor, Vanta What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" ....or the really scary one: "how do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security...

Legacy Windows protocols expose theft, Fortra admits GoAnywhere defect, Taiwan claims surge in Chinese attacks

Legacy Windows protocols still expose theft Fortra admits exploitation of GoAnywhere defect Taiwan claims surge in Chinese attack efforts Huge thanks to our sponsor, Vanta What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" ....or the really scary one: "how do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security...

Salesforce data leak, SimonMed breach, Chipmaker vs. Dutch government

Millions of records exposed in Salesforce data leak SimonMed breach grows from hundreds to over a million Dutch government freezes Chinese-owned chipmaker Huge thanks to our sponsor, Vanta What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" ....or the really scary one: "how do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and...

Velociraptor pushes LockBit, Spain dismantles crime group, SonicWall SSL VPN breach

Huge thanks to our sponsor, Vanta What's your 2 AM security worry? Is it "Do I have the right controls in place?" Or "Are my vendors secure?" ....or the really scary one: "how do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. Vanta also fits right into your workflows, using AI to streamline evidence collection, flag risks, and keep...

Week in Review: Crowdsourced ransomware campaign, Windows 10 woes, California opts out

Link to episode page This week's Cyber Security Headlines - Week in Review is hosted by Rich Stroffolino with guests Mike Lockhart, CISO Eagleview, and Dustin Sachs, chief technologist at CyberRisk collaborative, and author of Behavioral Insights in Cybersecurity Thanks to our show sponsor, ThreatLocker Cybercriminals don't knock they sneak in through the cracks other tools miss. That's why organizations are turning to ThreatLocker. As a zero-trust endpoint protection platform, ThreatLocker puts you back in control, blocking what doesn't belong and stopping attacks before they spread. Zero Trust security starts here with ThreatLocker" All links and the video of this...

Microsoft Azure outage, law firm cyberattack, Russian hacktivists pwned

Azure outage blocks access to Microsoft 365 services and admin portals Major U.S. law firm suffers cyberattack Hacktivists aiming for critical infrastructure get pwned Huge thanks to our sponsor, ThreatLocker Imagine having the power to decide exactly what runs in your IT environment and blocking everything else by default. That's what ThreatLocker delivers. As a zero-trust endpoint protection platform, ThreatLocker fills the gaps traditional solutions leave behind, giving your business stronger security and control. Don't just react to threats stop them with ThreatLocker. Learn more at ThreatLocker.com. Find the stories behind the headlines at CISOseries.com.

DeepMind fixes vulnerabilities, California offers data opt-out, China-Nexus targets open-source tool

Google DeepMind's AI agent finds and fixes vulnerabilities California law lets consumers universally opt out of data sharing China-Nexus actors weaponize 'Nezha' open source tool Huge thanks to our sponsor, ThreatLocker Cybercriminals don't knock they sneak in through the cracks other tools miss. That's why organizations are turning to ThreatLocker. As a zero-trust endpoint protection platform, ThreatLocker puts you back in control, blocking what doesn't belong and stopping attacks before they spread. Zero Trust security starts here with ThreatLocker. Learn more at ThreatLocker.com.

North Korean attackers steal crypto. Who's sending UK phones to China? Avnet confirms data breach

North Korean hackers steal more than $2B in crypto Group suspected of sending stolen UK phones to China Avnet confirms breach, says stolen data unreadable Huge thanks to our sponsor, ThreatLocker Imagine having the power to decide exactly what runs in your IT environment and blocking everything else by default. That's what ThreatLocker delivers. As a zero-trust endpoint protection platform, ThreatLocker fills the gaps traditional solutions leave behind, giving your business stronger security and control. Don't just react to threats stop them with ThreatLocker. Learn more at ThreatLocker.com.

Unity vulnerability, Oracle zero-day patched, Discord user info exposed

Unity vulnerability puts popular games at risk Oracle zero-day exploit patched Third-party breach claims Discord user info Huge thanks to our sponsor, ThreatLocker Cybercriminals don't knock they sneak in through the cracks other tools miss. That's why organizations are turning to ThreatLocker. As a zero-trust endpoint protection platform, ThreatLocker puts you back in control, blocking what doesn't belong and stopping attacks before they spread. Zero Trust security starts here with ThreatLocker. Learn more at ThreatLocker.com.

ParkMobile breach settlement, UK schools vulnerable, Zimbra calendar attacks

ParkMobile 2021 data breach class action suit concludes UK government study suggests secondary schools larger target than businesses Zimbra Collaboration Suite flaw used in calendar attacks Huge thanks to our sponsor, ThreatLocker Imagine having the power to decide exactly what runs in your IT environment and blocking everything else by default. That's what ThreatLocker delivers. As a zero-trust endpoint protection platform, ThreatLocker fills the gaps traditional solutions leave behind, giving your business stronger security and control. Don't just react to threats stop them with ThreatLocker. Learn more at ThreatLocker.com. Find the stories behind the headlines at CISOseries.com.

Week in Review: Shutdown furloughs CISA, DoD risk framework, Oracle extortion problem

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Nick Espinosa, nationally syndicated host of The Deep Dive Radio Show, with guest Steve Zalewski, co-host, Defense in Depth Thanks to our show sponsor, Nudge Security Here's the thing: your employees are signing up for new apps, sharing data, and connecting tools together, often without anyone knowing. And, AI adoption is accelerating this trend. What if you could continuously discover when people start using new apps or sharing data, then prompt them with security guidance right when and where they are working? At Nudge Security,...

Shutdown furloughs CISA, Defender BIOS bug, Motilily dealership cyberattack

Government shutdown furloughs most CISA staff Microsoft Defender bug triggers erroneous BIOS update alerts Motility RV software company suffers cyberattack Huge thanks to our sponsor, Nudge Security Here's the thing: your employees are signing up for new apps, sharing data, and connecting tools together, often without anyone knowing. And, AI adoption is accelerating this trend. What if you could continuously discover when people start using new apps or sharing data, then prompt them with security guidance right when and where they are working? At Nudge Security, we call that securing the Workforce Edge. Instead of trying to control everything (which,...

Breaches set for North America, Outlook bug needs Microsoft support, Air Force admits SharePoint issue

Breach notification letters set to flood North America's mailboxes New bug in classic Outlook only fixed via Microsoft support Air Force admits SharePoint privacy issue over breach Huge thanks to our sponsor, Nudge Security AI notetakers like Otter AI spread fast. In fact, one Nudge Security customer discovered 800 new accounts created in only 90 days. Viral AI notetakers introduce a slew of data privacy risks by gaining access to calendars and adding themselves to every meeting. Nudge Security can help. Within minutes of starting a free trial, you'll see every AI app, account, and integration, even those created in...

China-linked group linked to new malware, 2024 VMware zero-day still exploited, iOS fixes a bevy of glitches

China-Linked Group Hits Governments With Stealth Malware Chinese hackers exploit VMware zero-day since October 2024 Apple's iOS fixes a bevy of glitches Huge thanks to our sponsor, Nudge Security The SaaS supply chain is a hot mesh. As your workforce introduces new SaaS apps and integrations, hidden pathways are created that attackers can exploit to gain access to core business systems. That's exactly what happened in the Drift breach, and it will happen again. But, all is not lost. Nudge Security gives you the visibility and control you need to stop these attacks. Within minutes of starting a free trial,...

Microsoft blocks AI code, Breach hits WestJet, Harrods suffers new data incident

AI-generated code used in phishing campaign blocked by Microsoft WestJet notifies American consumers of data breach Ukrainian cops spoofed in fileless phishing attacks on Kyiv Huge thanks to our sponsor, Nudge Security AI tools have spread to every corner of your tech stack, which is great for innovation, but not so great for data governance. That's where Nudge Security comes in. Nudge discovers shadow AI across your org - chatbots, MCP integrations, AI in the supply chain, and more. And, Nudge delivers guardrails to employees to help you stop data leakage before it even starts. The best part? You'll have...

Dutch espionage arrest, DOD risk management framework, Oyster malvertising

Dutch teenagers arrested for attempted espionage for Russia DoD announces replacement for risk management framework Fake Microsoft Teams installers deliver Oyster malware Huge thanks to our sponsor, Nudge Security Here's the thing: your employees are signing up for new apps, sharing data, and connecting tools together, often without anyone knowing. And, AI adoption is accelerating this trend. What if you could continuously discover when people start using new apps or sharing data, then prompt them with security guidance right when and where they are working? At Nudge Security, we call that securing the Workforce Edge. Instead of trying to control...

Week in Review: Jaguar Land Rover attack, indirect prompt injections, card farms in NYC

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by David Spark with guests Brett Conlon, CISO, American Century Investments, and TC Niedzialkowski, Head of Security & IT, OpenDoor Thanks to our show sponsor, Conveyor Still stuck in security review chaos week after week? You're not the only one. But with Conveyor, teams finally get to a place of Questionnaire Zen. Our AI auto-fills answers across any format of questionnaire, even portals, and an enterprise-ready trust center keeps documents and policies ready for instant sharing. No more manual copy-pasting. No more last-minute scrambles. Just calm,...

Windows 10 extension, teenage Vegas hacker released, Boyd Gaming hacked

Microsoft to offer free Windows 10 security updates in Europe Teenage Vegas casino hacker released to parents Boyd Gaming hacked, employee data stolen Huge thanks to our sponsor, Conveyor Logging into yet another security questionnaire portal on a Friday at 3pm? Yeah, that's chaos. Conveyor AI is your fast path to calm. It finds every question no matter the format and fills in the answersacross portals, spreadsheets, PDFs, you name it. So instead of grinding through copy-paste, you get a first pass of accurate answers in minutes. Find your Friday Zen at www.conveyor.com. Find the stories behind the headlines at...

Suspect arrested over airport attack, DDoS attack hits new record, BRICKSTORM backdoor steals IPs

Person arrested in connection with airport attack Record-breaking DDoS attack hits new highs China-linked attackers use 'BRICKSTORM' backdoor to steal IP Huge thanks to our sponsor, Conveyor Security reviews don't have to feel like a hurricane. Most teams are buried in back-and-forth emails and never-ending customer requests for documentation or answers. But Conveyor takes all that chaos and turns it into calm. AI fills in the questionnaires, your trust center is always ready, and sales cycles move without stalls. Breathe easiercheck out Conveyor at www.conveyor.com.

European airports restore services, CISA deals with GeoServer exploit, Jaguar Land Rover extends shutdown

European airports restoring services after system breach CISA deals with GeoServer exploit App for outing Charlie Kirk's critics leaks personal data Huge thanks to our sponsor, Conveyor Have you been personally victimized by a questionnaire this week? The queue never ends. But Conveyor can change that story. With AI that answers questionnaires of any format, and a trust center that handles document sharing, security reviews get done without the stress. Feel calm in the chaos with Conveyor. Learn more at www.conveyor.com.

EDR-Freeze, DeepMind persuasion, vendors exit ATT&CK

EDR-Freeze tool suspends security software DeepMind updates Frontier Safety Framework Major vendors withdraw from MITRE EDR Evaluations Huge thanks to our sponsor, Conveyor Security reviews don't have to feel like a hurricane. Most teams are buried in back-and-forth emails and never-ending customer requests for documentation or answers. But Conveyor takes all that chaos and turns it into calm. AI fills in the questionnaires, your trust center is always ready, and sales cycles move without stalls. Breathe easiercheck out Conveyor at www.conveyor.com.

European airport cyberattack, SMS celltower scam, GPT4-powered ransomware

European airport disruption due to cyberattack check-in and baggage software SMS scammers now using mobile fake cell towers GPT-4-powered MalTerminal malware creates ransomware and Reverse Shell Huge thanks to our sponsor, Conveyor If security questionnaires make you feel like you're drowning in chaos, you're not alone. Endless spreadsheets, portals, and questionsalways when you least expect them. Conveyor brings calm to the storm. With AI that auto-fills questionnaires and a trust center that shares all your docs in one place, you'll feel peace where there used to be panic. Find your security review zen at www.conveyor.com. Find the stories behind the...

Week in Review: Student hackers increase, CISA wants CVE, Microsoft called hypocritical

Link to episode page This week'sCyber Security Headlines Week in Review is hosted by Rich Stroffolino with guests Jack Kufahl, CISO, Michigan Medicine, and Nick Espinosa, host, The Deep Dive Radio Show Thanks to our show sponsor, Drata Leading security teams trust SafeBase by Drata to turn trust into a growth engine. Our enterprise-grade Trust Center puts your security posture in one secure, customer-facing portal, giving buyers instant visibility into your company's continuous controls, certifications, and policies. With AI-powered Questionnaire Assistance, blast through inbound security questionnaires in minutes instead of days, automate cross functional workflows, and eliminate friction. That means...

Google patches zero-day, Copilot's forced installation, Scattered Spider arrests

Google patches sixth Chrome zero-day exploited in attacks this year Microsoft to force install the Microsoft 365 Copilot app in October Two more Scattered Spider teen suspects arrested Huge thanks to our sponsor, Drata Leading security teams trust SafeBase by Drata to turn trust into a growth engine. Our enterprise-grade Trust Center puts your security posture in one secure, customer-facing portal, giving buyers instant visibility into your company's continuous controls, certifications, and policies. With AI-powered Questionnaire Assistance, blast through inbound security questionnaires in minutes instead of days, automate cross functional workflows, and eliminate friction. That means less manual work, and...

Insight Partners warns thousands, Scattered Spider feigns retirement, Consumer Reports calls Microsoft 'hypocritical'

Insight Partners warns thousands after ransomware breach Scattered Spider gang feigns retirement, breaks into bank instead Consumer Reports calls Microsoft 'hypocritical' Huge thanks to our sponsor, Drata Leading security teams trust SafeBase by Drata to turn trust into a growth engine. Our enterprise-grade Trust Center puts your security posture in one secure, customer-facing portal, giving buyers instant visibility into your company's continuous controls, certifications, and policies. With AI-powered Questionnaire Assistance, blast through inbound security questionnaires in minutes instead of days, automate cross functional workflows, and eliminate friction. That means less manual work, and faster deal cycles. Win with Trust. Learn...

Cyber programs extended, older Apple devices attacked, chatbots aid phishing scams

House lawmakers move to extend two key cyber programs Apple 0-day likely used in spy attacks affected older devices Reuters crafts phishing scam with AI chatbot help Huge thanks to our sponsor, Drata Leading security teams trust SafeBase by Drata to turn trust into a growth engine. Our enterprise-grade Trust Center puts your security posture in one secure, customer-facing portal, giving buyers instant visibility into your company's continuous controls, certifications, and policies. With AI-powered Questionnaire Assistance, blast through inbound security questionnaires in minutes instead of days, automate cross functional workflows, and eliminate friction. That means less manual work, and faster...

Android security changes, CISA incentive audit, LLM usage

Android moving to "risk-based" security updates CISA accused of Cyber Incentive mismanagement How security practitioners use LLMs Huge thanks to our sponsor, Drata Leading security teams trust SafeBase by Drata to turn trust into a growth engine. Our enterprise-grade Trust Center puts your security posture in one secure, customer-facing portal, giving buyers instant visibility into your company's continuous controls, certifications, and policies. With AI-powered Questionnaire Assistance, blast through inbound security questionnaires in minutes instead of days, automate cross functional workflows, and eliminate friction. That means less manual work, and faster deal cycles. Win with Trust. Learn more at SafeBase.io.

ShinyHunters hits Vietnam, Petya-NotPetya copycat appears, CISA wants CVE

ShinyHunters hits Vietnam National Credit Information Center HybridPetya is a Petya/NotPetya copycat with UEFI Secure Boot bypass CISA seeks control over CVE Huge thanks to our sponsor, Drata Leading security teams trust SafeBase by Drata to turn trust into a growth engine. Our enterprise-grade Trust Center puts your security posture in one secure, customer-facing portal, giving buyers instant visibility into your company's continuous controls, certifications, and policies. With AI-powered Questionnaire Assistance, blast through inbound security questionnaires in minutes instead of days, automate cross functional workflows, and eliminate friction. That means less manual work, and faster deal cycles. Win with Trust....

Week in Review: Qantas penalizes executives, UK cyberlegislation delayed, SonicWall VPN flaws

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guests Rob Teel, CTO, Oklahoma Department of Commerce and Howard Holton, CEO, GigaOm Thanks to our show sponsor, Vanta Do you know the status of your compliance controls right now? Likeright now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta.Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They...

SonicWall VPM exploits, Fed cyberchief's priorities, U.S spyware investment triples

SonicWall SSL VPN flaws now being actively exploited Acting federal cyber chief outlines his priorities U.S. based investors in spyware firms nearly tripled in 2024 Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like...

npm update, Cursor Autorun flaw details, Microsoft probe over Ascension hack?

The npm incident: nothing to fret about? Cursor Autorun flaw lets repositories execute code without consent Senator Wyden urges FTC to probe Microsoft over Ascension hack Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows...

Blood center attack details emerge, Electoral Commission recovers, Plex suffers password breach

Thousands had data leaked in blood center ransomware attack UK Electoral Commission recovers, 3 years after China hack Npm packages with 2 billion weekly downloads targeted in supply chain attack Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They...

GhostAction campaign, scam centers grow, GPUGate hits IT

GhostAction campaign targets GitHub Scam centers see huge growth in Myanmar GPUGate targets IT firms Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security...

SVG phishing campaign, Anthropic piracy lawsuit, Qantas penalizes executives

New malware phishing campaign hidden in SVG files Anthropic agrees to pay $1.5bn in book piracy lawsuit Qantas penalizes executives for cyberattack Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews,...

Week in Review: Baltimore's expensive gaffe, ransomware takedown outcomes, Workiva Salesforce breach

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Ray Espinoza, vp of information security, Elite Technology Thanks to our show sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. All links and the video of this episode can be found on CISO Series.com

France cookie fines, CISA TP-Link KEV, sports piracy takedown

France fines Google and Shein over cookie misconduct CISA adds more TP-Link routers flaws to its KEV catalog World's largest sports piracy site shut down Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Fintech foils bank heist, NotDoor backdoor, Salesloft-Drift impact continues drifting

Fintech foils bank heist NotDoor backdoor Salesloft-Drift impact continues drifting Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Google: Gmail is secure, Cloudflare blocks largest DDoS attack, Amazon shutters theft campaign

'2.5 billion Gmail users at risk'? Entirely false, says Google Cloudflare blocks largest recorded DDoS attack peaking at 11.5 Tbps Jaguar Land Rover says cyberattack 'severely disrupted' production Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

LLM legalese prompts, Maryland Transit cyberattack, hacking into university

LegalPwn technique hides LLMs prompts inside contract legalese Maryland Transit investigating cyberattack Hacker attempts to forge his way into Spanish university Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Velociraptor C2 tunnel, Baltimore's expensive con, ransomware gangs multiply

Velociraptor forensic tool used for C2 tunneling City of Baltimore gets socially engineered to the tune of $1.5 million Ransomware gang takedowns create more smaller groups Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Week in Review: Citrix RCE flaw, steganography revived, major telecom fiasco

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Johna Till Johnson, CEO and founder, Nemertes Thanks to our show sponsor, Prophet Security Ever feel like your security team is stuck in a loop of alert fatigue and manual investigations? Meet Prophet Security. Their Agentic AI SOC Platform automates the tedious stuff: triaging, investigating, and responding to alerts - so your analysts can focus on real threats. Think 10x faster response times and a smarter way to secure your business. Learn more at prophetsecurity.ai. All links and the video of...

Malicious nx Packages, AI worker scam, Salt Typhoon attacks Netherlands

Malicious nx Packages leak GitHub, Cloud, and AI Credentials North Korean remote worker scheme boosted by generative AI The Netherlands announces Salt Typhoon penetration Huge thanks to our sponsor, Prophet Security Security teams are drowning in alerts - many companies generate upwards of 1000 or more alerts a day, and nearly half go ignored. That's where Prophet Security comes in. Their AI SOC platform automatically triages and investigates alerts, so your team can focus on real threats instead of busywork. Faster response, less burnout, and lower risk to your business. Learn more atprophetsecurity.ai. Find the stories behind the headlines at...

Salt Typhoon expands, AI-powered ransomware, Anthropic warns of vibe-hacking

FBI warns of expanded Chinese hacking campaign AI-powered ransomware is a thing now Anthropic warns about "vibe-hacking" Huge thanks to our sponsor, Prophet Security SOC analyst burnout is real - repetitive tasks, poor tooling, and constant alert noise are driving them out. Prophet Security fixes this. Their Agentic AI Analyst handles alert triage and investigation - work that 69% of cybersecurity leaders say is the best use for AI in the SOC. Say goodbye to burnout, and hello to efficiency. Check outprophetsecurity.ai.

DOGE puts critical SS data at risk? CISA warns of new exploited flaw, K-Pop stock heist attacker extradited to South Korea

DOGE Put Critical Social Security Data at Risk, Whistle-Blower Says CISA warns of actively exploited Git code execution flaw Alleged mastermind behind K-Pop celebrity stock heist extradited to South Korea Huge thanks to our sponsor, Prophet Security Your security analysts didn't sign up to chase false alarms all day. With Prophet Security's AI SOC platform, they won't have to. It works like a tireless teammatetriaging and investigating alerts around the clock. Less burnout. Better coverage. And more time for meaningful work. Learn more atprophetsecurity.ai.

Farmers Insurance also hit by Salesforce breach, UpCrypter phishing campaign, Pakistan hits Indian government agencies

If Salesforce flutters its wings in San Francisco... How is this still tricking people? From tagging to bagging Huge thanks to our sponsor, Prophet Security Security teams are drowning in alerts - many companies generate upwards of 1000 or more alerts a day, and nearly half go ignored. That's where Prophet Security comes in. Their AI SOC platform automatically triages and investigates alerts, so your team can focus on real threats instead of busywork. Faster response, less burnout, and lower risk to your business. Learn more atprophetsecurity.ai.

Malicious Go module, new Mirai botnet, Silk Typhoon exploits cloud

Malicious Go module steals credentials via Telegram Mirai-based botnet resurfaces targeting systems globally Silk Typhoon hackers exploit cloud trust to hack downstream customers Huge thanks to our sponsor, Prophet Security Ever feel like your security team is stuck in a loop of alert fatigue and manual investigations? Meet Prophet Security. Their Agentic AI SOC Platform automates the tedious stuff: triaging, investigating, and responding to alerts - so your analysts can focus on real threats. Think 10x faster response times and a smarter way to secure your business. Learn more at prophetsecurity.ai. Find the stories behind the headlines at CISOseries.com.

Week in Review: Celebrating 5 years of Cyber Security Headlines

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino. This is our milestone edition, celebrating five years of the daily Cyber Security Headlines news podcast. Our guests today will be the CSH reporters themselves, reflecting on some stories from this week as well as their favorite stories from the past few years. Joining Rich live will be Hadas Cassorla and Steve Prentice, with videos from Sarah Lane and Lauren Verno. Thanks to our show sponsor, Conveyor Does logging into a portal security questionnaire feel like punishment? We get it. Other solutions offer...

Apple's urgent update, Scattered Spider sentence, Microsoft seeks SSD feedback

Apple urges iPhone, iPad and Mac update ASAP Scattered Spider operative gets 10 years and a big fine Microsoft seeks customer feedback on SSD failure issues Huge thanks to our sponsor, Conveyor Does logging into a portal security questionnaire feel like punishment? We get it. Other solutions offer browser extensions that require you to do all the copy-pasting. It's slow, tedious, and frustrating. Conveyor takes care of it for you. Our AI auto-scrolls, finds every question, and fills in accurate answersall automatically.Oh, and our AI completes security questionnaires of any format, not just portals. Visit www.conveyor.com to learn more. Find...

Apple zero-day patch, Jailbreaking ChatGPT-5 Pro, 7-year old Cisco Vulnerability exploited

A patch today keeps the zero-day away Jailbreaking ChatGPT-5 Pro The thing about vulnerabilities is they stay vulnerable Huge thanks to our sponsor, Conveyor It's Thursday. Have you been personally victimized by a portal security questionnaire this week? Most solutions just give you a browser extension to copy and paste answers in, still leaving hours of manual work. With Conveyor, you don't have to slog through it yourself. Just open the portal and Conveyor's AI will scroll through each page, find the questions, and fill in answers for youstart to finish. See how at www.conveyor.com Find the stories behind the...

UK drops Apple backdoor mandate, Allianz Life breach impacts 1.1M, attack stifles speed cameras

UK agrees to drop 'backdoor' mandate for Apple devices Massive Allianz Life data breach impacts 1.1M people Speed cameras knocked out after cyber attack Huge thanks to our sponsor, Conveyor If portal questionnaires were a person, you'd block them by now. Endless clicks, bad navigation, and expanding questions stacked like russian nesting dolls, all add up to hours of your life you'll never get back. Conveyor's AI browser extension auto-completes any portal questionnaire without the copy and paste like those other browser extensions on the market. Spend less time battling portals and more time on work that matters. Learn more...

Workday breach, post-quantum alliance, Chinese group targets Taiwan

Workday confirms data breach An alliance to unify post-quantum cryptography New Chinese threat actor targeting Taiwan Huge thanks to our sponsor, Conveyor If the thought of logging into a portal questionnaire makes you want to throw your laptop away, you're not alone. Most solutions just give you a browser extension to copy and paste answers, still leaving hours of manual work. With Conveyor, you don't have to slog through it yourself. Just open the portal and Conveyor's AI will scroll through each page, find the questions, and fill in answers for youstart to finish. Spend less time battling portals and...

Cisco firewall warning, Colt Telecom cyberattack, CISA's OT request

Cisco warns of maximum-severity defect in firewall software UK's Colt Telecom suffers cyberattack CISA implores OT environments to lock down critical infrastructure Huge thanks to our sponsor, Conveyor Have you been personally victimized by portal security questionnaires? Conveyor is here to help. Endless clicks, bad navigation, and expanding questions stacked like Russian nesting dolls, all add up to hours of your life you'll never get back. With Conveyor's AI-powered browser extension, you can open a portal questionnaire, scan for questions, and watch it auto-populate your answers back into the portal without the copy and paste. See how at www.conveyor.com Find...

Week in Review: ShinyHunters-Scattered Spider merge, DARPA AI prize, Water infrastructure volunteers

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Steve Zalewski, co-host, Defense in Depth Thanks to our show sponsor, Vanta Do you know the status of your compliance controls right now? Likeright now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like...

NFC fraud reappears, Canada government breach, Zoom's critical flaw

New wave of NFC relay fraud, call hijacking, and root exploits in banking sector Canada's House of Commons suffers cyberattack Zoom fixes critical Windows client flaw that could enable privilege escalation Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001....

Court filing system hack explained, PA AG weighs in on attack, Fortinet attacks raise concerns

Hack of federal court filing system exploited security flaws known since 2020 Pennsylvania attorney general says cyberattack knocked phone, email systems offline Spike in Fortinet VPN brute-force attacks raises zero-day concerns Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001....

Fortinet SSL VPNs getting hammered, The Netherlands critical infrastructure compromise, Africa the most targeted for cyber attacks

The hits just keep on coming Where's the Little Dutch Boy when you need him? I felt the ransomware down in Africa Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews,...

North Korean crypto theft, Microsoft rolls out back up, four charged in global scheme

North Korean crypto theft Microsoft rolls out PC back up during attack U.S. charges four in $100M global fraud scheme Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting,...

DARPA code prize, ScarCruft adds ransomware, Columbia breach tally

DARPA awards $4 million prize for AI code review at DEF CON North Korea ScarCruft group adds ransomware to its activities Columbia University hack affects over 860,000 Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key...

Week in Review: UK LegalAid collapse, public ransomware approval, Salesforce breach impact

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Montez Fitzpatrick, CISO, Navvis Thanks to our show sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO All links and the video of this episode can be found on CISO Series.com

Hybrid Exchange flaw, France telecom breach, Dialysis company attack

Microsoft warns of high-severity flaw in hybrid Exchange deployments France's third-largest mobile operator suffers breach Dialysis company's April attack affects 900,000 people Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Gemini AI hijacked, Nvidia rejects AI chip backdoors, phishers abuse Microsoft 365

Hackers hijacked Google's Gemini AI with a poisoned calendar invite to take over a smart home Nvidia rejects US demand for backdoors in AI chips Google says hackers stole its customers' data by breaching its Salesforce database Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

PBS confirms data breach, TSMC fires engineers over theft, Cloudflare: Perplexity is web scraping

PBS confirms data breach after employee info leaked on Discord servers TSMC fires engineers over suspected semiconductor secrets theft Cloudflare on Perplexity web scraping techniques to avoid robot.txt and network blocks Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

Microsoft & Google lead zero day exploits, Plague Linux malware maintains SSH access, panel to create US Cyber Force

Microsoft and Google among most affected as zero day exploits jump 46% Vietnamese hackers use PXA Stealer, hit 4,000 IPs and steal 200,000 passwords globally New Plague Linux malware stealthily maintains SSH access Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

Akira's SonicWall zero-day, UK Legal-Aid suffers, Luxembourg 5G attack

Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Week in Review: Surveillance camera vulnerabilities, data sovereignty conundrum, French submarine cyberattack

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Derek Fisher, Director of the Cyber Defense and Information Assurance Program, Temple University also check out Derek's substack. Thanks to our show sponsor, Dropzone AI Security teams everywhere are drowning in alerts. That's why companies like Zapier and CBTS turned to Dropzone AIthe leader in autonomous alert investigation. Their AI investigates everything, giving your analysts time back for real security work. No more 40-minute rabbit holes. If you're at BlackHat, find them in Startup City. Otherwise, check out their self-guided demo...

ATM Raspberry Pi breach, Easterly West Point cancellation, Chinese company-hacker link

NATM network breached and attacked through 4G Raspberry Pi Easterly's appointment to West Point rescinded Report links Chinese companies to tools used by state-sponsored hackers Huge thanks to our sponsor, Dropzone AI Security teams everywhere are drowning in alerts. That's why companies like Zapier and CBTS turned to Dropzone AIthe leader in autonomous alert investigation. Their AI investigates everything, giving your analysts time back for real security work. No more 40-minute rabbit holes. If you're at BlackHat, find them in Startup City. Otherwise, check out their self-guided demo atdropzone.ai. This is how modern SOCs are scaling without burning out. Find...

Oh No! Lenovo, French submarine data breach, Russian pharmacy cyberattack

Oh No! Lenovo You sunk my battleship! Or did you? Russians unable to get a taste of their own medicine Huge thanks to our sponsor, Dropzone AI Security teams everywhere are drowning in alerts. That's why companies like Zapier and CBTS turned to Dropzone AIthe leader in autonomous alert investigation. Their AI investigates everything, giving your analysts time back for real security work. No more 40-minute rabbit holes. If you're at BlackHat, find them in Startup City. Otherwise, check out their self-guided demo atdropzone.ai. This is how modern SOCs are scaling without burning out. Find the stories behind the headlines...

Telecom Orange hacked, $2.4M Bitcoin seized from Chaos, Scattered Spider's tactics evolve

Critical Authentication Flaw Identified in Base44 Vibe Coding Platform French telecom giant Orange discloses cyberattack FBI seizes $2.4M in Bitcoin from new Chaos ransomware operation Huge thanks to our sponsor, Dropzone AI What if your SOC could investigate every single alert without burning out your team? That's exactly what Dropzone AI does. They're the leader in autonomous security investigations, and companies like Zapier and Fortune 500s are already on board. Their AI works alongside your analysts, handling the routine so humans can be strategic. See them at BlackHat in Startup City, booth 6427. Or experience it yourselfdropzone.ai has a self-guided...

Russian flights grounded, Naval group breach, dating app exposed

Hacktivist attack grounds Russian flights Naval group denies breach, hackers beg to differ Dating app breach exposes thousands of women's pictures Huge thanks to our sponsor, Dropzone AI Let me tell you about Dropzone AIthey're revolutionizing how security teams work. Companies like CBTS and Zapier use their AI to investigate alerts automatically, freeing up analysts for the work that really matters. We're talking 40-minute investigations done in 3 minutes. You can meet the Dropzone team at BlackHat in Startup City, or just head todropzone.ai for a self-guided demo. Trust me, this is the future of security operations.

NASCAR announces breach, Plankey for CISA, 365 Admin outage

NASCAR announces data breach following March cyberattack Plankey appears to be on track to lead CISA Microsoft investigates another outage affecting 365 admin center Huge thanks to our sponsor, Dropzone AI Today's sponsor is Dropzone AI, the leader in AI-powered SOC automation. Major companies like Zapier and UiPath are using Dropzone to give their security teams superpowers. Imagine your analysts focusing on real threats while AI handles every routine investigationin minutes, not hours. If you're heading to BlackHat, stop by their booth in Startup City. But you don't have to waitcheck out their self-guided demo atdropzone.ai and see why Fortune...

Week in Review: Aruba's hardcoded passwords, Clorox wipes supplier's mess, AI tool deletes everything

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Nick Espinosa, host, The Deep Dive Radio Show Thanks to our show sponsor, Nudge Security Nudge Security discovers new apps, accounts, and data-sharing in real-time and helps guide employees toward secure behaviors. Instead of trying to control everything, we give IT and security teams the visibility and automation they need to secure the Workforce Edge. All links and the video of this episode can be found on CISO Series.com

SonicWall releases patches, The Com warning, Compromised Amazon Q extension

SonicWall announces SMA 100 patches FBI warns about The Com Compromised Amazon Q extension deletes everything Huge thanks to our sponsor, Nudge Security Nudge Security discovers new apps, accounts, and data-sharing in real-time and helps guide employees toward secure behaviors. Instead of trying to control everything, we give IT and security teams the visibility and automation they need to secure the Workforce Edge. Find the stories behind the headlines at CISOseries.com.

Goodbye toha, AI deletes live data, Adobe apps advisory activated

Goodbye toha, or as they say in Russian, "Trust the AI," they said. "What could go wrong?" they said Adobe apps advisory activated Huge thanks to our sponsor, Nudge Security Trying to squeeze a few more items into your budget? Nudge Security can help by discovering up to TWO YEARS of historical SaaS spend along with usage insights so you can eliminate wasted spend. In fact, Nudge Security customer KarmaCheck was able to recoup 150% of their investment in Nudge within the first 6 months. See where you can save money by starting a free trial at nudgesecurity.com/spend.

Sharepoint hack linked to Chinese groups, NGOs targeted with phishing tactics, engineer admits US missile theft

Microsoft links Sharepoint ToolShell attacks to Chinese hackers Russian threat actors target NGOs with new OAuth phishing tactics Silicon Valley engineer admits theft of US missile tech secrets Huge thanks to our sponsor, Nudge Security Nudge Security discovers every SaaS app used in your org, secures configurations, enforces MFA, and manages app-to-app access so you can prevent identity based attacks. Start a free 14-day trial today at NudgeSecurity.com

SharePoint patched, World Leaks hits Dell, $44 million crypto theft

SharePoint RCE flaws patched and exploited from China Dell acknowledges World Leaks data breach $44 million stolen from crypto exchange Huge thanks to our sponsor, Nudge Security Nudge Security discovers every GenAI tool ever used in your org, even those you've never heard of. For each tool, you'll see who introduced it, who else is using it, where it's integrated into other tools, and a vendor security profile. Get your free GenAI inventory today at NudgeSecurity.com.

Aruba password warning, SharePoint zero day, Russian vodka maker attacked

Hewlett Packard warns of hardcoded passwords in Aruba access points SharePoint zero-day exploited via RCE, no patch available Russian vodka producer suffers ransomware attack Huge thanks to our sponsor, Nudge Security Discover every SaaS account ever created by anyone in your org within minutes of starting a free trial. Harden configs, enforce MFA, revoke risky app-to-app access, and more. Learn more at NudgeSecurity.com Find the stories behind the headlines at CISOseries.com.

Week in Review: Pentagon's Chinese Engineers, Gemini's email phish, 20-year-old railroad flaw persists

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Cyrus Tibbs, CISO, PennyMac Thanks to our show sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. All links and the video of this episode can be found on CISO Series.com

Taiwan semiconductor sector hacked, Salt Typhoon breaches National Guard, Congress ponders Stuxnet

Chinese hackers use Cobalt Strike on Taiwan's semiconductor sector Salt Typhoon breaches National Guard and steals network configurations Congress considers Stuxnet to manage OT threats Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Google's AI tool finds bugs, Europol disrupts hacktivist group, SquidLoader targets Hong Kong

Google says 'Big Sleep' AI tool found bug hackers planned to use Google fixes actively exploited sandbox escape zero day in Chrome China's cyber sector amplifies Beijing's hacking of U.S. targets Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

Chinese engineers at Pentagon, HazyBeacon malware, MITRE framework: AADAPT

Pentagon welcomes Chinese engineers into its environment HazyBeacon: It's not a beer, but it leaves a bitter aftertaste What the world needs now is another framework Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

EU age verification, train brakes vulnerability, Grok-4 jailbroken

EU states to test age verification app (Reuters) AAR pledges to start fixing 20-year old vulnerability next year (Security Week) Grok-4 jailbroken in two days (Infosecurity Magazine) DoD awards contracts for agentic AI (Reuters) eSIM vulnerability exposes billions of IoT devices (Infosecurity Magazine) UK launches Vulnerability Research Initiative (Bleeping Computer) Interlock ransomware using FileFix for malware (Bleeping Computer) Disinformation groups spoofs European journalists (The Record) Elmo gets hacked (AP News) Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with...

CitrixBleed2 urgent fix, Gemini email flaw, Louis Vuitton cyberattack

CISA gives one day for Citrix Bleed 2 fix Google Gemini flaw hijacks email summaries for phishing Louis Vuitton says UK customer data stolen in cyber-attack Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Week in Review: ChatGPT URL vulnerability, McDonald's password problem, Perfekt Bluetooth blunder

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Jim Bowie, vp, CISO, Tampa General Hospital Thanks to our show sponsor, Vanta Do you know the status of your compliance controls right now? Likeright now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows...

Outlook outage continues, Iranian APT activity, Russian ransomware arrest

Look Out! Another Outlook Outage Iranian APTs increased activity against U.S. industries in late spring Russian basketball player arrested in France over alleged ransomware ties Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like...

AMD has CPU meltdown, Mozilla Thunderbird has vulnerabilities, Indian defense sector attacked

AMD warns of new Meltdown, Spectre-like bugs affecting CPUs Multiple vulnerabilities in Mozilla Thunderbird could allow for arbitrary code execution Bitcoin Depot breach exposes data of nearly 27,000 crypto users, More than $40 million stolen from GMX crypto platform Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over...

Rubio Spoofed, RondoDox Botnet, Batavia Spyware

Four members of President Trump's cabinet impersonated Is this some kind of a game? Batavia attacks Russian industrial companies Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and...

Call of Duty game pulled, U.S. military gets cybersecurity boost, Bank employee helped hackers

Call of Duty game pulled from PC store after reported exploit U.S. military gets cybersecurity boost Bank employee helped hackers steal $100M Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews,...

Ingram Micro cyberattack, Telefonica possible breach, LLM URL recommendation problem

Ingram Micro suffers ransomware attack Hacker leaks Telefnica data allegedly from new breach ChatGPT prone to recommending wrong URLs, creating a new phishing opportunity Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies,...

Undetectable Android spyware is detectable, Hunters ransomware quits, Salt Typhoon dormant

Undetectable Android spyware leaks user logins Hunters ransomware group shuts doors Medical device company Surmodics reports cyberattack Huge thanks to our sponsor, Palo Alto Networks You're moving fast in the cloud and so are attackers. But while SecOps and cloud security teams are working in silos, attackers are exploiting the gaps between them. Cortex Cloud by Palo Alto Networks bridges this divide, unifying teams and stopping attacks with real-time cloud security that includes AI-powered protection, detection and automated response capabilities. Threats are stopped in minutes instead of days, and teams can finally protect cloud environments at the speed and scale...

Columbia hack, hunger relief ransomware, Qantas breach

Student data lost in Columbia University hack German hunger relief charity hit by ransomware Qantas contact center breached Huge thanks to our sponsor, Palo Alto Networks You're moving fast in the cloud and so are attackers. But while SecOps and cloud securityteams are working in silos, attackers are exploiting the gaps between them. Cortex Cloud by Palo Alto Networks bridges this divide, unifying teams and stopping attackswith real-time cloud security that includes AI-powered protection, detection and automatedresponse capabilities. Threats are stopped in minutes instead of days, and teams can finally protect cloudenvironments at the speed and scale of modern attacks....

Google issues Chrome security update, ICC targeted by new attack, Microsoft nixes Authenticator password management

Chrome Zero-Day CVE-2025-6554 under active attack Google issues security update International Criminal Court targeted by new 'sophisticated' attack Kelly Benefits says 2024 data breach impacts 550,000 customers, Esse Health says recent data breach affects over 263,000 patients Huge thanks to our sponsor, Palo Alto Networks You're moving fast in the cloud and so are attackers. But while SecOps and cloud securityteams are working in silos, attackers are exploiting the gaps between them. Cortex Cloud by Palo Alto Networks bridges this divide, unifying teams and stopping attackswith real-time cloud security that includes AI-powered protection, detection and automatedresponse capabilities. Threats are stopped...

New Iran warning, Chinese surveillance company banned, CISA names new executive director

U.S. agencies issue urgent warning over Iran threat Canada bans Chinese surveillance company CISA names new executive director Huge thanks to our sponsor, Palo Alto Networks You're moving fast in the cloud and so are attackers. But while SecOps and cloud securityteams are working in silos, attackers are exploiting the gaps between them. Cortex Cloud by Palo Alto Networks bridges this divide, unifying teams and stopping attackswith real-time cloud security that includes AI-powered protection, detection and automatedresponse capabilities. Threats are stopped in minutes instead of days, and teams can finally protect cloudenvironments at the speed and scale of modern attacks....

Hawaiian Airlines cyberattack, United Natural Foods update, Russia throttles Cloudflare

Hawaiian Airlines suffers cyberattack United Natural Foods says cyber incident will impact quarterly income Russia throttles Cloudflare making sites inaccessible Huge thanks to our sponsor, Palo Alto Networks You're moving fast in the cloud and so are attackers. But while SecOps and cloud securityteams are working in silos, attackers are exploiting the gaps between them. Cortex Cloud by Palo Alto Networks bridges this divide, unifying teams and stopping attackswith real-time cloud security that includes AI-powered protection, detection and automatedresponse capabilities. Threats are stopped in minutes instead of days, and teams can finally protect cloudenvironments at the speed and scale of...

Week in Review: Qilin adds lawyers, Iranian spearphishing campaign, Microsoft Direct Send hack

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Bil Harmer, operating partner and CISO, Craft Ventures. Check out Bil's page, KillSwitchAdvisory. Thanks to our show sponsor, ThreatLocker Alert fatigue, false positives, analyst burnoutyou know the drill. What if you could stop threats before they run? ThreatLocker gives CISOs what they've been asking for: real control at the execution layer. Only approved apps, scripts, and executables run. Period. Known-good is enforced. Everything else? Denied by default. Ringfencing and storage control keep even trusted tools in their laneso PowerShell doesn't become...

Iranian-backed spearphishing campaign, Microsoft Outlook fix, Glasgow suffers cyberattack

Iranian-backed spearphishing campaign seeks out cybersecurity experts Microsoft fixes Outlook bug causing crashes when opening emails Glasgow City Council suffers cyberattack Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Patient death linked to ransomware, BreachForums busted again, nOAuth vulnerability

NHS confirms patient death linked to ransomware attack BreachForums busted again Thousands of SaaS apps still vulnerable to nOAuth Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

70 Microsoft Exchange servers targeted, Apple, Netflix, Microsoft sites hacked, data breach hits Aflac

Hackers target over 70 Microsoft Exchange servers to steal credentials via keyloggers Apple, Netflix, Microsoft sites 'hacked' for tech support scams The 2022 initiative by Cloudflare, CrowdStrike and Ping Identity provided cybersecurity support to critical infrastructure sectors seen as potential targets of Russia-linked attacks Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

Retaliatory Iranian cyberattacks, steel giant confirms breach, ransomware hits healthcare system again

DHS warns of retaliatory Iranian cyberattacks Steel giant Nucor confirms breach Ransomware hits healthcare system again Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

CMS retailer report, Aflac investigates activity, Russian dairy cyberattack

CMC officially points finger at Scattered Spider for Marks & Spencer and Co-op attacks Aflac investigating suspicious activity on its U.S. network Russian dairy producers suffer cyberattack Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Week in Review: ClickFake deepfake scam, Krispy Kreme breach, NIST ZTA guidance

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Howard Holton, COO and industry analyst, GigaOm Thanks to our show sponsor, Adaptive Security As deepfake scams and GenAI phishing evolve,Adaptive equips security teams with AI-powered phishing simulations featuring realistic personalized deepfakes and engaging security awareness training. Their new AI Content Creator turns threat intel and policy updates into interactive, multilingual training instantly. Trusted by Fortune 500s and backed by Andreessen Horowitz and OpenAI, Adaptive helps youstay ahead of AI-driven threats. Learn more at adaptivesecurity.com. All links and the video of...

Cisco, Atlassian fixes, Ryuk member arrested, Viasat Typhoon attack

Cisco, Atlassian fix high-severity vulnerabilities Alleged Ryuk ransomware gang member arrested and extradited Telecom company Viasat attacked by Salt Typhoon Huge thanks to our sponsor, Adaptive Security OpenAI's first cybersecurity investment As deepfake scams and GenAI phishing evolve, Adaptive equips security teams with AI-powered phishing simulations featuring realistic personalized deepfakes and engaging security awareness training. Their new AI Content Creator turns threat intel and policy updates into interactive, multilingual training instantly. Trusted by Fortune 500s and backed by Andreessen Horowitz and OpenAI, Adaptive helps youstay ahead of AI-driven threats. Learn more at adaptivesecurity.com. Find the stories behind the headlines at...

Episource Breach, Predatory Sparrow strikes again, Swiss banks data leak

Over 5 million impacted by Episource breach Predatory Sparrow strikes Iran again Data leak at Swiss banks Huge thanks to our sponsor, Adaptive Security OpenAI's first cybersecurity investment As deepfake scams and GenAI phishing evolve, Adaptive equips security teams with AI-powered phishing simulations featuring realistic personalized deepfakes and engaging security awareness training. Their new AI Content Creator turns threat intel and policy updates into interactive, multilingual training instantly. Trusted by Fortune 500s and backed by Andreessen Horowitz and OpenAI, Adaptive helps youstay ahead of AI-driven threats. Learn more at adaptivesecurity.com.

Hackers exploit Langflow flaw, TP-Link routers still vulnerable, Russia detects SuperCard malware attacks

Hackers exploit critical Langflow flaw to unleash Flodrix botnet Organizations warned of vulnerability exploited against discontinued TP-Link routers Russia detects first SuperCard malware attacks skimming bank data via NFC Huge thanks to our sponsor, Adaptive Security OpenAI's first cybersecurity investment As deepfake scams and GenAI phishing evolve, Adaptive equips security teams with AI-powered phishing simulations featuring realistic personalized deepfakes and engaging security awareness training. Their new AI Content Creator turns threat intel and policy updates into interactive, multilingual training instantly. Trusted by Fortune 500s and backed by Andreessen Horowitz and OpenAI, Adaptive helps youstay ahead of AI-driven threats. Learn more...

2FA middleman, Archetyp seized, Zoomcar hacked

Beware the SMS 2FA middleman Police seize Archetyp Market Zoomcar hack impacts 8.4 million users Huge thanks to our sponsor, Adaptive Security As deepfake scams and GenAI phishing evolve, Adaptive equips security teams with AI-powered phishing simulations featuring realistic personalized deepfakes and engaging security awareness training. Their new AI Content Creator turns threat intel and policy updates into interactive, multilingual training instantly. Trusted by Fortune 500s and backed by Andreessen Horowitz and OpenAI, Adaptive helps youstay ahead of AI-driven threats. Learn more at adaptivesecurity.com.

Washington Post hacked, WestJet suffers cyberattack, Texas DoT breach

Washington Post investigates hacking incident on journalists' emails Canadian airline WestJet is containing a cyberattack Crash records stolen from Texas DOT Huge thanks to our sponsor, Adaptive Security OpenAI's first cybersecurity investment As deepfake scams and GenAI phishing evolve, Adaptive equips security teams with AI-powered phishing simulations featuring realistic personalized deepfakes and engaging security awareness training. Their new AI Content Creator turns threat intel and policy updates into interactive, multilingual training instantly. Trusted by Fortune 500s and backed by Andreessen Horowitz and OpenAI, Adaptive helps youstay ahead of AI-driven threats. Learn more at adaptivesecurity.com. Find the stories behind the headlines...

Week in Review: Google and Cloudflare outages, Copilot Zero-Click, Cloudflare's Claude flair

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Christina Shannon, CIO, KIK Consumer Products Thanks to our show sponsor, Vanta Is your manual GRC program slowing you down? There's something more efficient than spreadsheets, screenshots, and manual processes Vanta. With Vanta, GRC can be so. much. easierwhile also strengthening your security posture and driving revenue for your business. Vanta automates key areas of your GRC programincluding compliance, risk, and customer trustand streamlines the way you manage information. The impact is real: A recent IDC analysis found that compliance teams...

Microsoft Entra attack, Thursday's Cloud outages, Mark Green retires

Hackers attacks target Microsoft Entra ID accounts using pentesting tool Google Cloud and Cloudflare outages reported House Homeland Chairman Mark Green announces his departure Huge thanks to our sponsor, Vanta Is your manual GRC program slowing you down? There's something more efficient than spreadsheets, screenshots, and manual processes Vanta. With Vanta, GRC can be so. much. easierwhile also strengthening your security posture and driving revenue for your business. Vanta automates key areas of your GRC programincluding compliance, risk, and customer trustand streamlines the way you manage information. The impact is real: A recent IDC analysis found that compliance teams using...

CoPilot zero-click, Operation Secure, FIN6 targets recruiters

Zero-click data leak flaw in Copilot Operation Secure targets infostealer operations FIN6 targets recruiters Huge thanks to our sponsor, Vanta Is your manual GRC program slowing you down? There's something more efficient than spreadsheets, screenshots, and manual processes Vanta. With Vanta, GRC can be so. much. easierwhile also strengthening your security posture and driving revenue for your business. Vanta automates key areas of your GRC programincluding compliance, risk, and customer trustand streamlines the way you manage information. The impact is real: A recent IDC analysis found that compliance teams using Vanta are one hundred and twenty nine percent more productive....

40K IoT cameras stream secrets to browsers, Marks & Spencer taking online orders post-cyberattack, PoC Code escalates Roundcube Vuln threat

CISA, Microsoft warn of Windows zero-day used in attack on 'major' Turkish defense org 40K IoT cameras worldwide stream secrets to anyone with a browser Marks & Spencer begins taking online orders again, out for seven weeks due to cyberattack Huge thanks to our sponsor, Vanta Is your manual GRC program slowing you down? There's something more efficient than spreadsheets, screenshots, and manual processes Vanta. With Vanta, GRC can be so. much. easierwhile also strengthening your security posture and driving revenue for your business. Vanta automates key areas of your GRC programincluding compliance, risk, and customer trustand streamlines the way...

Cybersecurity News: Brute forcing Google accounts, Guardian's Secure Messaging, UNFI cyberattack

Brute forcing phone numbers linked to Google accounts The Guardian launches Secure Messaging service United Natural Foods hit by cyberattack Huge thanks to our sponsor, Vanta Is your manual GRC program slowing you down? There's something more efficient than spreadsheets, screenshots, and manual processes Vanta. With Vanta, GRC can be so. much. easierwhile also strengthening your security posture and driving revenue for your business. Vanta automates key areas of your GRC programincluding compliance, risk, and customer trustand streamlines the way you manage information. The impact is real: A recent IDC analysis found that compliance teams using Vanta are one hundred...

Cyber executive order, Neuberger's infrastructure warning, Mirai botnet warning

Presidential cyber executive order signed Neuberger warns of U.S. infrastructure's cyberattack weakness Mirai botnet infects TBK DVR devices Huge thanks to our sponsor, Vanta Is your manual GRC program slowing you down? There's something more efficient than spreadsheets, screenshots, and manual processes Vanta. With Vanta, GRC can be so. much. easierwhile also strengthening your security posture and driving revenue for your business. Vanta automates key areas of your GRC programincluding compliance, risk, and customer trustand streamlines the way you manage information. The impact is real: A recent IDC analysis found that compliance teams using Vanta are one hundred and twenty...

Week in Review: Senators' CSRB bid, Deepfakes dodge detection, Microsoft-CrowdStrike collaboration

Link to episode page This week's Cyber Security Headlines - Week in Review is hosted by Rich Stroffolino with guest Rusty Waldron, chief business security officer, ADP Thanks to our show sponsor, Conveyor Let me guess, another security questionnaire just landed in your inbox. Which means all the follow up tasks you don't have time for are close behind.What are you going to do? Here's a better question: what would Sue do? Sue is Conveyor's new AI Agent for Customer Trust. She handles the entire security review process like answering every customer request from sales, completing every questionnaire or executing...

Kettering data published, Reddit sues Anthropic, North Face breached

Stolen Kettering Health data published Reddit sues Anthropic for scraping North Face website customer accounts breached Huge thanks to our sponsor, Conveyor Let me guess, another security questionnaire just landed in your inbox. Which means all the follow up tasks you don't have time for are close behind. What are you going to do? Here's a better question: what would Sue do? Sue is Conveyor's new AI Agent for Customer Trust. She handles the entire security review process like answering every customer request from sales, completing every questionnaire or executing every communications and coordination task in-between. No more manual work....

Russian bomber maker popped, vishing targets Salesforce, MS helps out governments

Ukraine claims cyberattack on Russian bomber maker Vishing campaign targets Salesforce Microsoft lends a hand to European governments Huge thanks to our sponsor, Conveyor Ever wish you had a teammate that could handle the most annoying parts of customer security reviews? You know, chasing down SMEs for answers, updating systems, coordinating across teamsall the grunt work nobody wants to do. Plus, having to finish the dang questionnaire itself. Well. That teammate existsConveyor just launched Sue, the first AI Agent for Customer Trust. Sue really is the dream teammate. She never misses a deadline, answers every customer request from sales, completes...

Meta, Yandex take heat on browsing identifiers, Acreed malware makes gains, HPE warns of critical auth bypass

Meta and Yandex are de-anonymizing Android users' web browsing identifiers LummaC2 fractures as Acreed malware becomes top dog Hewlett Packard Enterprise warns of critical StoreOnce auth bypass Huge thanks to our sponsor, Conveyor Tired of herding cats to complete customer security questionnaires? Your team probably spends hours daily juggling the back and forth of completing these security requests. That's why Conveyor created Sue, the first AI Agent for Customer Trust. Sue doesn't just handle completing security questionnaires and sending SOC 2 to prospects she manages all the communication and follow-up too. You simply get notified when everything's done so you...

MS and CrowdStrike partner, Qualcomm bugs exploited, new CISA cut details

Microsoft and CrowdStrike partner to link threat actor names Qualcomm sees Adreno bugs under active exploitation New details on proposed CISA cuts Huge thanks to our sponsor, Conveyor Does trying to get the security questionnaire done and back to your customer ever feel like you're herding cats? It's not answering questions - most of you have automation software for that. It's all of the manual back and forth that becomes a slog like communicating between teams, tracking people down to get their review, updating sources and updating systems. Conveyor just launched an AI agent, Sue, to do all of these...

Cisco IOS XE exploit, Senators' CSRB request, Australia ransomware law

Exploit for maximum severity Cisco IOS XE flaw now public Senators as for reinstatement of cyber review board to work on Salt Typhoon investigation Australian ransomware victims now must report their payments Huge thanks to our sponsor, Conveyor Conveyor launched the first AI Agent for Customer Trust. So wtf does that mean? It means the AI agent goes beyond just sharing NDA-gated documents like a SOC 2 with customers or answering security questionnaires. Conveyor's AI Agent, Sue, handles the entire security review process from start to finish. She answers every customer request from sales, completes every questionnaire and executes every...

Week in Review: Chrome password replacer, Luna Moth exploits, ChatGPT declines shutdown command

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Steve Knight, former CISO, Hyundai Capital America Thanks to our show sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. All links and the video of this episode can be found on CISO Series.com

Windows startup failures, Victoria's Secret cyberattack, stolen cookie threat

Windows 11 might fail to start after installing KB5058405, says Microsoft Victoria's Secret website goes offline following cyberattack Billions of stolen cookies available, worrying security experts Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Microsoft updates Update, LexisNexis leak, cyber insurance premiums

Microsoft wants to update all the things LexisNexis breach impacts 364,000 people Cyber insurance premium volume expected to double Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

MathWorks confirms ransomware attack, Adidas has data breach, Dutch intelligence warns of cyberattack

MathWorks, Creator of MATLAB, Confirms Ransomware Attack Adidas warns of data breach after customer service provider hack Dutch Intelligence Agencies Say Russian Hackers Stole Police Data in Cyberattack Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

Malicious npm codes, Nova Scotia cyberattack, ChatGPT refuses shutdown command

Malicious npm and VS Code packages stealing data Nova Scotia Power confirms ransomware attack Researchers claim ChatGPT o3 bypassed shutdown in controlled test Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

CISA's Commvault warning, updated Killnet returns, fake VPN malware

CISA warns Commvault clients of campaign targeting cloud applications Russian hacker group Killnet returns with slightly adjusted mandate Fake VPN and browser NSIS installers used to deliver Winos 4.0 malware Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Week in Review: Disabling Microsoft Defender, corrupted power inverters, bipartisan training bill

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest George Finney, CISO, The University of Texas System check out George's new book plus all his other achievements at his website, WellAwareSecurity. Thanks to our show sponsor, Conveyor Still spending hours maintaining a massive spreadsheet of Q&A pairs or using RFP tools to answer security questionnaires? Conveyor's AI doesn't need hand-holding and gets you accurate answers every time with limited knowledge base maintenance. It reads directly from your connected sourcesdocuments, wikis, websites, Confluence, Google drive, and even your Conveyor trust center....

Signal shutters Recall, Windows Server vulnerability, pathology lab breach

Signal adds Recall blocker Critical Windows Server 2025 dMSA vulnerability warning Pathology lab suffers data breach Huge thanks to our sponsor, Conveyor Still spending hours maintaining a massive spreadsheet of Q&A pairs or using RFP tools to answer security questionnaires? Conveyor's AI doesn't need hand-holding and gets you accurate answers every time with limited knowledge base maintenance. It reads directly from your connected sourcesdocuments, wikis, websites, Confluence, Google drive, and even your Conveyor trust center. You don't maintain a knowledge base. You connect to one. And our AI does the rest for you. See what real auto-fill magic looks like...

Kettering Health outage, Lumma disrupted, Opexus "major lapse"

Ransomware attack knocks out Kettering Health Lumma malware operation disrupted Federal agencies impacted by "major lapse" at Opexus Huge thanks to our sponsor, Conveyor Half-baked AI answers to security questionnaires are worse than no answer at all. Conveyor's AI gets it right the first timewith market-leading accuracy rates and full citations for every response. Because "good enough" doesn't cut it when you're filling in questionnaires daily. Accuracy isn't just a featureit's the foundation. Because we know that when AI gets it wrong, you're stuck with more work. If AI isn't living up to its promise with other tools, check out...

DOJ investigates Coinbase attack, Dutch cyber-espionage law passes, VanHelsing ransomeware leaked

US DOJ opens investigation into Coinbase's recent cyberattack Dutch government passes law to criminalize cyber-espionage Ransomware attack on food distributor spells more pain for UK supermarkets Huge thanks to our sponsor, Conveyor What if your sales team could answer security questions themselveswithout blowing up your Slack or email every 10 minutes? With Conveyor, they can. Conveyor is the trust center and security questionnaire automation tool your infosec friends love to use. Whether through Slack or the Conveyor app, sales and presales teams can easily get AI-generated answers to any customer security question, with your pre-set rules and reviews in place....

Legal Aid breached, patients at risk from cyberattacks, 23andMe buyer

UK's Legal Aid Agency breached NHS patients put at risk from cyberattacks 23andMe has a buyer Huge thanks to our sponsor, Conveyor Ever spent an hour in a clunky portal questionnaire with UI from 1999 just to lose your work because it timed out? Conveyor's got you. Our browser extension completes questionnaires in the most tedious portals for you by auto-importing all the questions and generating AI answers. For popular portals, it can go full autopilot and fill in reviewed answers into the portal on one click. You shouldn't have to fight a portal just to prove your security posture....

UK retailer update, Microsoft Defender disabler, deepfakes target officials

Scattered Spider facilitates UK retail hacks and is moving to the U.S. Defendnot tool can disable Microsoft Defender FBI warns government officials about new waves of deepfakes Huge thanks to our sponsor, Conveyor Are you dealing with security questionnaire chaos this week? If so, get Conveyor's AI to knock them out for you. Connect Conveyor to any source, easily upload any format of questionnaire or use the browser extension for portals and their AI handles the restfrom parsing the questions to generating answers and auto-tagging collaborators. Let Conveyor do the work for you. Learn more at www.conveyor.com. Find the stories...

Week in Review: Hackers pump stocks, Microsoft stops screenshots, AI encrypts cybersecurity

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Nick Espinosa, host, The Deep Dive Radio Show. Here's where you can find him: Daily Podcast on SoundCloud | YouTube | Forbes | Twitter/X | Facebook | BlueSky | Mastodon Thanks to our show sponsor, Vanta Do you know the status of your compliance controls right now? Likeright now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls...

Coinbase hackers bribe staff, Windows 11 hacked at Pwn2Own, Telegram purges black market group

Coinbase says hackers bribed staff to steal customer data and are demanding $20 million ransom Windows 11 and Red Hat Linux hacked on first day of Pwn2Own The Internet's biggest-ever black market just shut down amid a Telegram purge Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over...

Attack on steel producer, EUVD online, CISA advisory overhaul

Steel producer disrupted by cyberattack European Vulnerability Database (EUVD) is online CISA pauses advisory overhaul Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security...

Radware clarifies patch, retailer data stolen, Alabama suffers cyberattack

Radware says recently WAF bypasses were patched in 2023 Marks & Spencer confirms data stolen in ransomware attack Alabama suffers cybersecurity event Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews,...

GlobalX breach, Google settles lawsuits, UK software security guidelines

Global Crossing Airlines Group confirms cyberattack Google settles privacy lawsuits UK launches software security guidelines Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security...

Japan finance hacks, Pearson suffers cyberattack, Teams blocks screen captures

Hackers hijack Japanese financial accounts to conduct billions in trades Education giant Pearson hit by cyberattack exposing customer data Microsoft Teams will soon block screen capture during meetings Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize...

Week in Review: Agriculture ransomware increase, Congress challenges CISA cuts, Disney's slacker hacker

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Dan Holden, CISO, BigCommerce Thanks to our show sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. All links and the video of this episode can be found on CISO Series.com

Cisco IOS XE vulnerability, Pentagon CIO nomination, new SonicWall vulnerability

Cisco patches a level 10 vulnerability in IOS XE President nominates former Unilever CISO to be Pentagon CIO SonicWall patches a new zero-day vulnerability Thanks to today's episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Europol shuts down DDoS-for-hire services, CrowdStrike lays off 500 workers, GOV.UK embraces passkeys

Europol shuts down six DDoS-for-hire services used in global attacks CrowdStrike says it will lay off 500 workers Passkeys set to protect GOV.UK accounts against cyber-attacks Thanks to today's episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Congress challenges CISA cuts, Texas school breached, NSO pays WhatsApp

Congress challenges Noem over proposed CISA cuts Texas school district breach impacts over 47,000 people NSO Group to pay WhatsApp $167 million in damages Thanks to today's episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Signal clones, easyjson warning, UK retail hacker

Signal clone gets hacked Sounding the alarm on easyjson Ransomware group takes credit for UK retail attacks Thanks to today's episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Microsoft Authenticator passkeys, StealC malware upgraded, CISA budget slashed

Microsoft ends Authenticator password autofill in favor of Edge StealC malware enhanced with stealth upgrades and data theft White House proposes cutting $491M from CISA budget Thanks to today's episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Week in Review: Cybersecurity CEO busted, Cloudflare's DDoS increase, FBI's help request

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest DJ Schleen, Head of Security, Boats Group Thanks to our show sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. All links and the video of this episode can be found on CISO Series.com

UK's Co-op cyberattack, LabHost domains released, NSO WhatsApp damages

UK retailer Co-Op suffers cyberattack FBI shares list of 42,000 LabHost phishing domains NSO group looking at hefty damages in WhatsApp case Thanks to today's episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Scattered Spider extradition, Telecom hack warnings, Impersonation scammer takedown

Alleged 'Scattered Spider' member extradited to U.S. Experts see little progress after major Chinese telecom hack Polish police take down impersonation scammers Thanks to today's episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. For the stories behind the headlines, visit CISOseries.com.

Apple Airplay-Enabled Devices Can Be Hacked, Google tracked 75 zero days, France ties Russian APT28 hackers to 12 cyberattacks

Millions of Apple Airplay-Enabled Devices Can Be Hacked via Wi-Fi Google tracked 75 zero days exploited in the wild in 2024 France ties Russian APT28 hackers to 12 cyberattacks on French orgs Thanks to today's episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

Uyghur software malware, DDoS jumps, 4chan back

Uyghur Language Software Hijacked to Deliver Malware Cloudflare sees a big jump in DDoS attacks 4chan back online Thanks to today's episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO.

SAP zero-day active, another OAuth exploit, cybersecurity CEO arrested

SAP zero-day vulnerability under widespread active exploitation Hackers abuse OAuth 2.0 workflows to hijack Microsoft 365 accounts Cybersecurity firm CEO charged with installing malware on hospital systems Thanks to today's episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com/CISO. Find the stories behind the headlines at CISOseries.com.

Week in Review: Secure by Design departure, Microsoft's security report, LLMs outrace vulnerabilities

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Bethany De Lude, CISO emeritus, The Carlyle Group Thanks to our show sponsor, Dropzone AI Alert investigation is eating up your security team's day30 to 40 minutes per alert adds up fast. Dropzone AI's SOC Analyst transforms this reality by investigating every alert with expert-level thoroughness at machine speed. Our AI SOC Analyst gathers evidence, connects the dots across your security tools, and delivers clear reports with recommended actionsall in minutes. No playbooks to build, no code to write. Just consistent,...

Russian army map malware, edge tech attack report, Commvault flaw

Russian army targeted by Android malware hidden in mapping app Attackers hit security device defects hard in 2024 Critical Commvault Command Center flaw warning Huge thanks to our sponsor, Dropzone AI Alert investigation is eating up your security team's day30 to 40 minutes per alert adds up fast. Dropzone AI's SOC Analyst transforms this reality by investigating every alert with expert-level thoroughness at machine speed. Our AI SOC Analyst gathers evidence, connects the dots across your security tools, and delivers clear reports with recommended actionsall in minutes. No playbooks to build, no code to write. Just consistent, high-quality investigations that...

Blue Shield of California shared private data,FBI IC3 report, Ex-Army sergeant jailed

Blue Shield of California shared private health data of millions with Google The FBI issues its 2024 IC3 report Ex-Army sergeant jailed for selling military secrets Huge thanks to our sponsor, Dropzone AI Security analysts need practical experience to build investigation skills, but getting expert guidance for every alert is impossible. That's why Dropzone AI created COACHa free Chrome extension that serves as an AI security mentor for SOC analysts at any level. COACH reads alerts across all major security platforms, explains their context, provides alternative hypotheses, and guides analysts through industry-standard investigation methodologies. Unlike our AI SOC Analyst product,...

Microsoft Recall updates, Russian orgs deal with networking software updates, SSL.com certificate issuance vulnerability

Microsoft Recall on Copilot+ PC: testing the security and privacy implications Russian organizations targeted by backdoor masquerading as secure networking software updates SSL.com Scrambles to Patch Certificate Issuance Vulnerability Huge thanks to our sponsor, Dropzone AI Is your security team spending too much time chasing alerts instead of stopping threats? Dropzone AI modernizes your security operations by handling the routine investigations that consume your team's day. Our AI SOC Analyst works with your existing security tools, learns your environment, and delivers clear, actionable reports within minutes. Your human analysts can finally focus on the most critical threats. Organizations using our...

Google OAuth abused, Japan's trading scams, hijacking with Zoom

Google OAuth abused in DKIM replay attack Japan warns of sharp rise in unauthorized trading North Koreans hijacking Zoom's Remote Control Huge thanks to our sponsor, Dropzone AI Security threats don't clock out at 5 PM, but your analysts need to sleep sometime. Dropzone AI delivers around-the-clock alert investigations with the same attention to detail at midnight as at noon. Our AI SOC Analyst ensures no more morning backlogs and no more off-hours blind spots. Just reliable, continuous protection that ensures every alert gets the attention it deserves, regardless of when it arrives. See how SOC teams are achieving true...

Microsoft Entra lockouts, wine tasting malware, job scam solution

Widespread Microsoft Entra lockouts cause by new security feature rollout Malware delivered through diplomatic wine-tasting invites British companies told to hold in-person interviews to thwart North Korea job scammers Huge thanks to our sponsor, Dropzone AI Growing your MSSP client roster while your alerts are multiplying? Dropzone AI works alongside your team, investigating alerts just like your best human analysts would. Our AI SOC Analyst cuts investigation time from an hour to minutes while handling five times more alerts per analyst. Unlike complex SOAR solutions, Dropzone deploys quickly and adapts to your environment without the need for playbooks or coding....

Week in Review: CISA workforce cuts, AI slopsquatting risk, CVE funding saga

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by David Spark with guest Trina Ford, CISO, iHeartMedia Thanks to our show sponsor, Vanta Do you know the status of your compliance controls right now? Likeright now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access...

Cyberthreat sharing law renewal, APTs love ClickFix, GoDaddy mutes Zoom

Bipartisan push for renewal of cyberthreat information sharing law ClickFix becoming a favorite amongst state-sponsored hackers GoDaddy puts Zoom on mute for about 90 minutes Thanks to this week's episode sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows...

MITRE bailout, Krebs exits SentinelOne, Apple fixes zero-days

MITRE gets last-minute bailout from CISA Krebs exits SentinelOne after security clearance pulled Apple fixes two zero-days exploited in targeted iPhone attacks Thanks to this week's episode sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. For the stories behind the headlines, visit CISOseries.com. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001....

BREAKING: CVE Funding Doesn't Lapse

CISA issued a statement that it execution an option on its contract with MITRE to continue funding the CVE program.

Government CVE funding set to end, 4chan down following an alleged hack, China accuses US of launching advanced cyberattacks

Government CVE funding set to end Tuesday 4chan, the internet's most infamous forum, is down following an alleged hack China accuses US of launching 'advanced' cyberattacks, names alleged NSA agents Thanks to this week's episode sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001....

Slopsquatting risks, Morocco leak, EC ups US-based staff security

AI code dependencies are a supply chain risk Morocco investigates social security leak European Commission increases security measures for US-bound staff Thanks to this week's episode sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews,...

CISA cuts planned, Windows 'inetpub' warning, health lab breach

Major workforce cuts planned for CISA Microsoft warns Windows users not to delete 'inetpub' folder Data breach at testing lab affects 1.6 million people Thanks to this week's episode sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like...

Week in Review: Fake ChatGPT passport, Apple appeals UK encryption, Oracle's obsolete servers

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Carla Sweeney, SVP, InfoSec, Red Ventures Thanks to our show sponsor, Nudge Security Are you struggling to secure your exploding SaaS footprint? With Nudge Security, you can discover all SaaS apps and accounts, manage access, ensure secure configurations, vet unfamiliar tools, and automate daily identity security tasks. Start a free 14-day trial All links and the video of this episode can be found on CISO Series.com

Krebs probed, Nissan Leaf hack, Typhoon tariff warning

President orders probe of former CISA Director Chris Krebs Nissan Leaf cars can be hacked for remote spying and physical takeover Infosec experts warn of China Typhoon retaliation against tariffs Thanks to our episode sponsor, Nudge Security Are you struggling to secure your exploding SaaS footprint? With Nudge Security, you can discover all SaaS apps and accounts, manage access, ensure secure configurations, vet unfamiliar tools, and automate daily identity security tasks. Start a free 14-day trial Find the stories behind the headlines at CISOseries.com.

OCC major incident, Oracle confirms hack, Smokeloader servers seized

U.S. Comptroller suffers 'major incident' Oracle confirms "obsolete servers" hacked Police seize Smokeloader malware servers and detain customers Thanks to our episode sponsor, Nudge Security Nudge Security is the only solution for SaaS security and governance that can discover up to two years of historical SaaS spend along with usage insights so you can uncover wasted spend and sources of unnecessary risk. Start a free 14-day trial today For the stories behind the headlines, visit CISOseries.com.

New WhatsApp vulnerability, Microsoft patches 125 Windows Vulns, Fake Microsoft Office add-in tools push malware

WhatsApp vulnerability could facilitate remote code execution Spyware targeting Chinese diaspora Microsoft Patches 125 Windows Vulns, Including Exploited CLFS Zero-Day Thanks to our episode sponsor, Nudge Security Nudge Security provides advanced security posture management for Okta, Microsoft 365, Google Workspace, and other critical apps. With Nudge, you'll be alerted of risks like weak or missing MFA, inactive admin accounts, and risky integrations, plus you can automate remediation tasks and on-going identity governance. Start a free 14-day trial today

Apple encryption appeal, Xanthorox AI tool, weaponizing CRM

Apple appeals UK encryption back door order Researchers warn about AI-driven hacking tool PoisonSeed campaign weaponizes CRM system Thanks to our episode sponsor, Nudge Security Nudge Security discovers every GenAI tool ever used in your org, even those you've never heard of. For each tool, you'll see who introduced it, who else is using it, where it's integrated into other tools, and a vendor security profile. Get your free GenAI inventory today.

NSA Haugh fired, New WinRAR flaw, ChatGPT fake passport

Haugh fired from leadership of NSA and Cyber Command WinRAR flaw bypasses Windows Mark of the Web security alerts Researcher creates fake passport using ChatGPT Thanks to our episode sponsor, Nudge Security Nudge Security helps you mitigate security risks stemming from SaaS sprawl by discovering every SaaS account ever created by anyone in your org within minutes of starting a free trial. And, you can automate on-going governance tasks like security posture checks, user access reviews, employee offboarding, and more. Start a free 14-day trial Find the stories behind the headlines at CISOseries.com.

Week in Review: Microsoft's account bypass, CrushFTP CVE clash, 23andMe warning

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Howard Holton, COO and industry analyst, GigaOm Thanks to our show sponsor, Qualys Overwhelmed by noise in your cybersecurity processes? Cut through the clutter with Qualys Enterprise TruRisk Management. Quantify your cyber risk in clear financial terms and focus on what matters most. Actionable insights help you prioritize critical threats, streamline remediation, and accelerate risk reduction while effectively communicating impact to stakeholders. Empower your cybersecurity strategy with tools that drive faster, smarter, and more efficient risk management. Your secure future starts...

Google patches Quick Share, ChatGPT temporary outage, UK Mail breach

Google patches Quick Share vulnerability ChatGPT suffered brief outage Wednesday UK's Royal Mail investigates data leak claims Thanks to today's episode sponsor, Qualys "Overwhelmed by noise in your cybersecurity processes? Cut through the clutter with Qualys Enterprise TruRisk Management. Quantify your cyber risk in clear financial terms and focus on what matters most. Actionable insights help you prioritize critical threats, streamline remediation, and accelerate risk reduction while effectively communicating impact to stakeholders. Empower your cybersecurity strategy with tools that drive faster, smarter, and more efficient risk management. Your secure future starts today with Qualys Enterprise TruRisk Management. Visit qualys.com/etm for...

North Korean IT workers move into Europe, Stripe API skimming unveils theft techniques, Verizon API flaw exposes call history

North Korean IT worker army expands operations in Europe Stripe API skimming campaign unveils new techniques for theft Verizon call filter API flaw exposed customers' incoming call history Thanks to today's episode sponsor, Qualys "Overwhelmed by noise in your cybersecurity processes? Cut through the clutter with Qualys Enterprise TruRisk Management. Quantify your cyber risk in clear financial terms and focus on what matters most. Actionable insights help you prioritize critical threats, streamline remediation, and accelerate risk reduction while effectively communicating impact to stakeholders. Empower your cybersecurity strategy with tools that drive faster, smarter, and more efficient risk management. Your secure...

Mozilla Thunderbird takes on Gmail, surge in scans on PAN GlobalProtect VPNs, Microsoft uncovers bootloader vulnerabilities

Mozilla Thunderbird finally takes on Gmail with new email service Surge in scans on PAN GlobalProtect VPNs hints at attacks Microsoft Using AI to Uncover Critical Bootloader Vulnerabilities Thanks to today's episode sponsor, Qualys "Overwhelmed by noise in your cybersecurity processes? Cut through the clutter with Qualys Enterprise TruRisk Management. Quantify your cyber risk in clear financial terms and focus on what matters most. Actionable insights help you prioritize critical threats, streamline remediation, and accelerate risk reduction while effectively communicating impact to stakeholders. Empower your cybersecurity strategy with tools that drive faster, smarter, and more efficient risk management. Your secure...

FTC's warning to 23andMe buyer, global phishing threats, Samsung breach

FTC sends warning to future 23andMe buyer Global phishing threat targets 88 countries Samsung data breach tied to old stolen credentials Thanks to today's episode sponsor, Qualys "Overwhelmed by noise in your cybersecurity processes? Cut through the clutter with Qualys Enterprise TruRisk Management. Quantify your cyber risk in clear financial terms and focus on what matters most. Actionable insights help you prioritize critical threats, streamline remediation, and accelerate risk reduction while effectively communicating impact to stakeholders. Empower your cybersecurity strategy with tools that drive faster, smarter, and more efficient risk management. Your secure future starts today with Qualys Enterprise TruRisk...

Document converter warning, Resurge exploits Ivanti, Blacklock hackers exposed

FBI warns of increase in free online document converter scams Resurge malware exploits Ivanti flaw BlackLock hackers exposed through leak site vulnerability Thanks to today's episode sponsor, Qualys "Overwhelmed by noise in your cybersecurity processes? Cut through the clutter with Qualys Enterprise TruRisk Management. Quantify your cyber risk in clear financial terms and focus on what matters most. Actionable insights help you prioritize critical threats, streamline remediation, and accelerate risk reduction while effectively communicating impact to stakeholders. Empower your cybersecurity strategy with tools that drive faster, smarter, and more efficient risk management. Your secure future starts today with Qualys Enterprise...

Week in Review: Microsoft Trust abuse, 23andMe bankruptcy risks, NIST's growing backlog

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Jonathan Waldrop, CISO, The Weather Company Jonathan will be speaking at The CrowdStrike Crowd Tour, on Tuesday, April15, 2025 in Atlanta details here. He will also be speaking at the C Vision International Think Tank on April 24, 2025, also in Atlanta details here. Thanks to our show sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the...

JavaScript injection campaign, solar power vulnerabilities, SIM swap lawsuit

150,000 sites compromised by JavaScript injection Vulnerabilities in numerous solar power systems found T-Mobile pays $33 million in SIM swap lawsuit Huge thanks to our episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com. Find the stories behind the headlines at CISOseries.com.

Ransomware group claims attack on US telecom firm, New ReaderUpdate malware variants target macOS users, Oracle customers claim stolen data

New ransomware group claims attack on US Telecom firm WideOpenWest NSA warned of vulnerabilities in Signal app a month before Houthi strike chat New ReaderUpdate malware variants target macOS users Huge thanks to our episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com.

EncryptHub exploit, Copilot agents, PETs in government

EncryptHub linked to Microsoft Management Console exploit Security Copilot gets AI agents A call for more PETs in government Huge thanks to our episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com.

Hundreds of cyber criminals arrested, 23andMe data, Ukraine railway partially taken down

More than 300 cyber criminals arrested in Africa 23andMe bankruptcy puts millions of DNA records at risk Ukraine's state railway partially down after attack Huge thanks to our episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com.

Tornado cash sanctions lifted, Russia Cloudflare outage, Microsoft Trust abused

U.S. Treasury lifts sanctions on Tornado Cash Web service outage in Russia due to reported Cloudflare block Microsoft Trust Signing service abused to code-sign malware Huge thanks to our episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com. Find the stories behind the headlines at CISOseries.com.

Week in Review: Google acquires Wiz, water utility improvements, more GitHub attacks

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Christina Shannon, CIO, KIK Consumer Products Thanks to our show sponsor, DeleteMe Data brokers bypass online safety measures to sell your name, address, and social security number to scammers. DeleteMe scours the web to find and remove your private information before it gets into the wrong hands by scanning for exposed information, and completing opt-outs and removals. With over 100 Million personal listings removed, DeleteMe is your trusted privacy solution for online safety. Get 20% off your DeleteMe plan when you...

Stalkerware company breach, Microsoft Zero Day, Global Jira attack

Stalkerware company SpyX suffers data breach Nation-state groups hit organizations with Microsoft Windows zero-day Swiss telecom Ascom the latest victim of HellCat's Jira campaign Thanks to this week episode sponsor, DeleteMe Data brokers bypass online safety measures to sell your name, address, and social security number to scammers. DeleteMe scours the web to find and remove your private information before it gets into the wrong hands by scanning for exposed information, and completing opt-outs and removals. With over 100 Million personal listings removed, DeleteMe is your trusted privacy solution for online safety. Get 20% off your DeleteMe plan when you...

PA teachers union breach, Infosys settles lawsuit, Sperm bank data theft

Attackers swipe data from Pennsylvania teachers union Infosys settles $17.5M lawsuit after third-party breach Top U.S. sperm bank discloses data breach Thanks to this week episode sponsor, DeleteMe Data brokers bypass online safety measures to sell your name, address, and social security number to scammers. DeleteMe scours the web to find and remove your private information before it gets into the wrong hands by scanning for exposed information, and completing opt-outs and removals. With over 100 Million personal listings removed, DeleteMe is your trusted privacy solution for online safety. Get 20% off your DeleteMe plan when you go to JoinDeleteMe.com/CISO...

Google Acquires Wiz, CISA must reinstate terminated employees, Commerce Department bans DeepSeek

CISA scrambles to contact fired employees after court rules layoffs 'unlawful' Google acquires cybersecurity firm Wiz for $32 billion US Commerce department bureaus ban China's DeepSeek on government devices, sources say Thanks to this week episode sponsor, DeleteMe Data brokers bypass online safety measures to sell your name, address, and social security number to scammers. DeleteMe scours the web to find and remove your private information before it gets into the wrong hands by scanning for exposed information, and completing opt-outs and removals. With over 100 Million personal listings removed, DeleteMe is your trusted privacy solution for online safety. Get...

GitHub repositories targeted, Apache Tomcat RCE exploit, BEC campaigns target Microsoft 365

23,000 repositories targeted in popular GitHub action Apache Tomcat RCE exploit hits serversno authentication required Microsoft 365 users targeted in new BEC campaigns Thanks to this week episode sponsor, DeleteMe Data brokers bypass online safety measures to sell your name, address, and social security number to scammers. DeleteMe scours the web to find and remove your private information before it gets into the wrong hands by scanning for exposed information, and completing opt-outs and removals. With over 100 Million personal listings removed, DeleteMe is your trusted privacy solution for online safety. Get 20% off your DeleteMe plan when you go...

VPN brute-force attacks, water utilities bill, LockBit developer extradited

Black Basta creates tool to automate VPN brute-force attacks Bipartisan Senate bill offers improved cybersecurity for water utilities LockBit developer extradited from Israel, appears in New Jersey court Thanks to this week episode sponsor, DeleteMe Data brokers bypass online safety measures to sell your name, address, and social security number to scammers. DeleteMe scours the web to find and remove your private information before it gets into the wrong hands by scanning for exposed information, and completing opt-outs and removals. With over 100 Million personal listings removed, DeleteMe is your trusted privacy solution for online safety. Get 20% off your...

Week in Review: ONCD dominates cyber, undocumented Bluetooth commands, DoJ Google breakup

Link to episode page Thanks to our show sponsor, Vanta Do you know the status of your compliance controls right now? Likeright now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, And helps you get security questionnaires done 5 times faster with AI. Now that'sa new way...

Medusa ransoms infrastructure, Google breakup sought, more Booking.com phishing

Medusa ransomware continues to attack infrastructure DoJ seeks to break up Google Another phishing campaign hits Booking.com Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, And helps you...

Microsoft patches 57 security flaws, Sola aims to build the 'Stripe for security', US council wants to counter China threats

Microsoft Patches 57 Security Flaws, Including 6 Actively Exploited Zero-Days US communications regulator to create council to counter China technology threats Signal no longer cooperating with Ukraine on Russian cyberthreats, official says Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO...

New CISA head, Ballista botnet, PowerSchool breach report

Sean Plankey nominated to head CISA Ballista Botnet hits TP-Link devices PowerSchool publishes breach report Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, And helps you get security...

Healthcare breaches expose thousands, X outage, MGM suit dropped

Four healthcare breaches expose over 560,000 records Cyber attack allegedly behind X outages Case against MGM ransomware attack dropped Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, And...

ONCD consolidates power, undocumented Bluetooth commands, Japan NTT Breach

ONCD set to consolidate power in U.S. cyber Undocumented commands found in Bluetooth chip used by a billion devices Japanese telecom NTT breach affects 18,000 companies Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows...

Week in Review: Hegseth orders stand down, ransomware by snailmail, Mark Cuban's lifeline

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by David Spark with guest Brett Perry, CISO, Dot Foods Thanks to our show sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com. All links and the video of this episode can be found on CISO Series.com

Company hacked via webcam, Toronto Zoo update, federal contractor obligations

Ransomware gang bypasses EDR via a webcam Toronto Zoo updates January 2024 attack damage House bill requires federal contractors to implement vulnerability disclosure policies Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com. Then add: Find the stories behind the headlines at CISOseries.com.

Probationary firing protest, hacker names frustration, conversational scam detector

Former top NSA cyber official protests probationary firings Differing names for hackers hinders law enforcement, says security agent Google releases AI scam detection for Android to fight conversational fraud Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com. Find the stories behind the headlines at CISOseries.com.

Apple vs UK encryption backdoor, VMware bugs allow sandbox escape, JavaGhost targets AWS

Apple goes to court to fight UK demand for iCloud encryption backdoor 3 VMware Zero-Day bugs allow sandbox escape The Firefox I loved is gone - how to protect your privacy on it now Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com.

CISA denies claims, Ransomware group claims attack, Latin America's security crisis

CISA denies claims of deprioritizing Russian threats Ransomware group claims attack on U.S. newspaper publisher Latin America's escalating cybersecurity crisis Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com.

Hegseth orders standdown, Microsoft terminates Skype, Cuban offers lifeline

Hegseth orders Cyber Command to stand down on Russia planning Microsoft hangs up on Skype after 14 years Mark Cuban offers to fund government tech unit that was cut Huge thanks to our sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com. Find the stories behind the headlines at CISOseries.com.

Week in Review: Apple encryption, gamification for security, DISA breach

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Andrew Wilder, CISO, Vetcor Thanks to our show sponsor, Conveyor Let me guess, another security questionnaire just landed in your inbox. Which means all the follow up tasks you don't have time for are close behind. What are you going to do? Here's a better question: what would Sue do? Sue is Conveyor's new AI Agent for Customer Trust. She handles the entire security review process like answering every customer request for a SOC 2 from sales, completing every questionnaire or...

Cyber espionage increase, Nakasone cyber warning, PolarEdge exploits Cisco

Chinese cyber espionage jumped 150% last year Nakasone warns of U.S. falling behind adversaries in cyberspace PolarEdge botnet exploits Cisco, ASUS, QNAP, and Synology Huge thanks to our sponsor, Conveyor Let me guess, another security questionnaire just landed in your inbox. Which means all the follow up tasks you don't have time for are close behind. What are you going to do? Here's a better question: what would Sue do? Sue is Conveyor's new AI Agent for Customer Trust. She handles the entire security review process like answering every customer request for a SOC 2 from sales, completing every questionnaire...

GitHub repos exposed, HaveIBeenPwned adds 244M stolen passwords, Anagram gamifies cybersecurity training

Thousands of exposed GitHub repositories, now private, can still be accessed through Copilot Cellebrite halts product use in Serbia following Amnesty surveillance report New Ghostwriter campaign targets Ukrainian Government and opposition activists in Belarus Huge thanks to our sponsor, Conveyor It's 2025. This is your second sign to get a trust center if you don't already have one. Reduce manual work by 80% when you can share one link to your trust center and let customers download what they need on demand. Trusted by the world's top B2B companies, Conveyor's enterprise-grade trust center is specially designed to handle multiple products,...

DISA breach, Swedish backdoors, Dems looking into system access

US employee screening firm confirms breach Swedish law enforcement seeking messaging app backdoors Dems warn of exposed entry points on government systems Huge thanks to our sponsor, Conveyor Ever wish you had a teammate that could handle the most annoying parts of customer security reviews? You know, chasing down SMEs for answers, updating systems, coordinating across teamsall the grunt work nobody wants to do. Plus, having to finish the dang questionnaire itself. Well. That teammate existsConveyor just launched Sue, the first AI Agent for Customer Trust. Sue really is the dream teammate. She never misses a deadline, answers every customer...

Australia bans Kaspersky, Government screens hijacked, EU sanctions Lazarus Group

Australia bans Kaspersky over security concerns Government screens hijacked with AI Video of President Trump and Musk EU sanctions North Korean official linked to Lazarus Group Huge thanks to our sponsor, Conveyor Does trying to get the security questionnaire done and back to your customer ever feel like you're herding cats? It's not just answering questions. It's all of the manual back and forth that becomes a slog like communicating between teams, tracking people down to get their review, updating sources and updating systems. Between all of this, you're also expected to field security documentation requests from customers. Well, Conveyor...

$1.5B Bybit hack, UK E2E pulled, PayPal phishing emails

Hacker steals nearly $1.5 billion from Bybit crypto wallet Apple pulls iCloud end-to-end encryption in the UK PayPal "New Address" feature abused in phishing scam Huge thanks to our sponsor, Conveyor It's 2025. This is your sign to get a trust center if you don't already have one. Speed up security reviews and reduce the headaches when you can share one link to your trust center and let customers download what they need on demand. Trusted by the world's top B2B companies, Conveyor's enterprise-grade trust center is specially designed to handle multiple products, complex orgs, and with AI first so...

Week in Review: More telecoms breached, Chase blocks Zelle, more DeepSeek bans

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest TC Niedzialkowski, former CISO Thanks to our show sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. All links and the video of this episode can be found on CISO Series.com

NioCorp BEC scam, Australian IVF breach, SEC's cyber unit

Minerals company loses $500,000 to BEC scam Australian IVF provider investigating cyber incident SEC replaces cryptocurrency fraud unit with emerging tech team Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. Find the stories behind the headlines at CISOseries.com.

Signal conversations hacked, Ransomware group hits infrastructure, Patch Palo Alto flaw

Russian hackers tap into Signal conversations Ransomware group hits critical infrastructure globally CISA says patch Palo Alto flaw immediately Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io.

OpenSSH flaws enable new attacks, Microsoft prepares for deprecation, Zwipe files for bankruptcy

New OpenSSH Flaws Enable Man-in-the-Middle and DoS Attacks Patch Now Microsoft reminds admins to prepare for WSUS driver sync deprecation Zwipe runs out of time for biometric card revenues, files for bankruptcy Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io.

Zservers takedown, Zelle payment blocks, Finastra data breach

Dutch Police take down Zservers Chase to block Zelle payments to sellers on social media Finastra notifies victims of October data breach Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. For the stories behind the headlines, visit CISOseries.com.

Device code attacks, phone TOAD solution, more telecoms breached

Hackers steal emails in device code phishing attacks Anti-TOAD feature seeks to prevent in-call sideloading attacks Chinese hackers breach more U.S. telecoms via unpatched Cisco routers Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io.

Week in Review: CISA officials furloughed, DeepSeek's weak security, Cairncross as cyberdirector

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Doug Mayer, vp, CISO, WCG Thanks to our show sponsor, Vanta Do you know the status of your compliance controls right now? Likeright now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies,...

Apple backdoor spat, Sarcoma hits Unimicron, Sault Tribe attacked

U.S. lawmakers demand UK retraction of Apple backdoor Sarcoma ransomware claims breach at giant PCB maker Unimicron Ransomware attack disrupts Michigan's Sault Tribe operations Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies,...

DOGE hacks America? U.S. adversaries turn to cybercriminals? New LiDAR system ID faces a km away?

DOGE is hacking America This Ad-Tech company is powering surveillance of US military personnel Apple and Google take down malicious mobile apps from their app stores Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows...

LockBit host sanctions, DeepSeek security, trojanized KMS

LockBit host sanctioned A peak at DeepSeek's weak security Sandworm targeting Ukraine with trojanized KMS Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security...

Urgent iOS update, CISA officials on administrative leave, newspaper operations impacted

Urgent iOS update fixes critical USB security flaw CISA officials placed on administrative leave Attack disrupts newspaper giant's operations Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and...

DOGE outrage and lawsuit, CISA KEV additions, DeepSeek encryption lapses

Shock and lawsuit over security failures in DOGE takeover CISA adds Microsoft Outlook and Sophos XG Firewall to its Known Exploited Vulnerabilities catalog DeepSeek App transmits sensitive user and device data without encryption Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and...

Week in Review: APTs using Gemini, ransomware payments decrease, abandoned AWS risk

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Caitlin Sarian, owner and CEO, Cybersecurity Girl LLC Thanks to our show sponsor, ThreatLocker ThreatLocker (R) is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com. All links and the video of this episode can be found on CISO Series.com

Outlook RCE bug, Kimsuky forceCopy malware, Treasury tightens DOGE

Critical RCE bug in Microsoft Outlook now exploited in attacks Kimsuky uses forceCopy malware to steal browser-stored credentials Treasury agrees to block additional DOGE staff from accessing sensitive payment systems Huge thanks to our episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com. Find the stories behind the headlines at CISOseries.com.

Spain arrests hacker, FCC Robocallers, Ransoms decrease 35%

Spain arrests hacker of U.S. and Spanish military agencies Robocallers called the FCC pretending to be from the FCC Ransomware payments decreased 35% year-over-year Huge thanks to our episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com. For the stories behind the headlines, visit CISOseries.com.

Meta identifies risky AI systems, Ferret malware joins 'Contagious Interview' campaign, credential theft rises as a target

Meta says it may stop development of AI systems it deems too risky Ferret Malware Added to 'Contagious Interview' Campaign Credential Theft Becomes Cybercriminals' Favorite Target Huge thanks to our episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com. Find the stories behind the headlines at CISOseries.com.

Exploited vulnerabilities rising, ban on DeepSeek, crypto scams make comeback

Exploited vulnerabilities up significantly from previous year First U.S. state to declare ban on DeepSeek Crypto scams make comeback on X Huge thanks to our episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com.

APTs using Gemini, India's Tata cyberattack, new WhatsApp spyware

Google describes APTs using Gemini AI India's Tata Technologies suffers ransomware attack Meta confirms new zero-click WhatsApp spyware Huge thanks to our episode sponsor, ThreatLocker ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com.

Week in Review: Google vishing response, DeepSeek peak week, ransomware victim costs

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Alexandra Landegger, Global Head of Cyber Strategy & Transformation, RTX Thanks to our show sponsor, Conveyor Let me guess, another security questionnaire just landed in your inbox. Which means all the follow up tasks you don't have time for are close behind. What are you going to do? Here's a better question: what would Sue do? Sue is Conveyor's new AI Agent for Customer Trust. She handles the entire security review process like answering every customer request from sales, completing every...

Blood Center cyberattack, DeepSeek data leak, CISA's future unclear

New York Blood Center suffers ransomware attack DeepSeek's exposed database leaks sensitive data CISA's future unclear under new administration Huge thanks to our sponsor, Conveyor Let me guess, another security questionnaire just landed in your inbox. Which means all the follow up tasks you don't have time for are close behind. What are you going to do? Here's a better question: what would Sue do? Sue is Conveyor's new AI Agent for Customer Trust. She handles the entire security review process like answering every customer request from sales, completing every questionnaire or executing every communications and coordination task in-between. No...

Tenable acquires Vulcan Cyber, Chinese and Iranian hackers are using U.S. AI, US Navy bans use of DeepSeek

Tenable acquiring Israel's Vulcan Cyber in $150 million deal Chinese and Iranian Hackers Are Using U.S. AI Products to Bolster Cyberattacks U.S. Navy bans use of DeepSeek due to 'security and ethical concerns' Huge thanks to our sponsor, Conveyor Ever wish you had a teammate that could handle the most annoying parts of customer security reviews? You know, chasing down SMEs for answers, updating systems, coordinating across teamsall the grunt work nobody wants to do.Plus, having to finish the dang questionnaire itself.Well. That teammate existsConveyor just launched Sue, the first AI Agent for Customer Trust. Sue really is the dream...

Ransomware shutdowns, GRU sanctions, Lynx ransomware details

Most ransomware victims shut down operations shutdowns EU sanctions GRU members for Estonia cyberattacks Lynx ransomware runs a tight ship Huge thanks to our sponsor, Conveyor Tired of herding cats to complete customer security questionnaires? Your team probably spends hours daily juggling the back and forth of completing these security requests. That's why Conveyor created Sue, the first AI Agent for Customer Trust. Sue doesn't just handle completing security questionnaires and sending SOC 2 to prospects she manages all the communication and follow-up too. You simply get notified when everything's done so you can do a quick review. Stop wrangling...

Sophisticated voice phishing, Opengrep consortium, DeepSeek suspends registrations

Google responds to "most sophisticated" voice phishing attack Security consortium creates Opengrep DeepSeek suspends new user registrations Huge thanks to our sponsor, Conveyor Tired of herding cats to complete customer security questionnaires? Your team probably spends hours daily juggling the back and forth of completing these security requests. That's why Conveyor created Sue, the first AI Agent for Customer Trust. Sue doesn't just handle completing security questionnaires and sending SOC 2 to prospects she manages all the communication and follow-up too. You simply get notified when everything's done so you can do a quick review. Stop wrangling cats and see...

CISA Board closed, UnitedHealth numbers rise, Llama's LLM vulnerability

DHS Advisory Committee memberships halted UnitedHealth updates number of data breach victims to 190 million Meta's Llama Framework flaw exposes AI systems to remote code execution risks Huge thanks to our sponsor, Conveyor Conveyor launched the first AI Agent for Customer Trust. So wtf does that mean? It means the AI agent goes beyond just sharing NDA-gated documents like a SOC 2 with customers or answering security questionnaires. Conveyor's AI Agent, Sue, handles the entire security review process from start to finish. She answers every customer request from sales, completes every questionnaire and executes every communications and coordination task in-between.It's...

Week in Review: Tik Tok's return, Noem's CISA plans, failed startup risks

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Shaun Marion, vp, CSO, Xcel Energy Thanks to our show sponsor, Vanta Do you know the status of your compliance controls right now? Likeright now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like...

TSA's Pekoske ousted, CISOs' boardroom gain, Cisco vulnerability fix

TSA cyber chief David Pekoske ousted by new administration CISOs gain boardroom traction Influence but still lack soft skills, says Splunk Cisco Fixes vulnerability in Meeting Management Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key...

DHS terminates the Cyber Security Review Board, Major cybersecurity vendors' credentials found on Dark Web, Trump pardons creator of Silk Road

Trump administration fires members of cybersecurity review board in 'horribly shortsighted' decision Major Cybersecurity Vendors' Credentials Found on Dark Web PowerSchool hacker claims they stole data of 62 million students Thanks to today's episode sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls withVanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also...

7-Zip flaw, CERT-UA impersonation, AI EO revoked

7-Zip flaw bypasses Windows security warnings Attackers impersonate Ukraine's CERT-UA AI Executive Order revoked Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, And helps you get security questionnaires...

HPE breach claims, CIA analyst guilty, Hotel data exposed

HPE investigates breach claims Former CIA analyst pleads guilty to sharing Top Secret files Data of nearly half million hotel guests exposed Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews,...

Tik Tok returns, Noem's CISA plans, Avery labels breach

Tik Tok is back, with strings attached Noem promises to curtail CISA Label company Avery announces data breach Huge thanks to our sponsor, Vanta Do you know the status of your compliance controls right now? Like...right now? We know that real-time visibility is critical for security, but when it comes to our GRC programswe rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, And helps...

Week in Review: IRS PIN available, AI ransomware group, UK ransomware ban

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Phil Beyer, head of security, Flex Thanks to our show sponsor, Dropzone.ai What if your SOC could handle 10x the alerts without burning out your team? Dropzone AI automates Tier 1 investigations and frees your analysts to tackle bigger challenges. It's how smart teams are staying ahead. See how it worksschedule a demo today at dropzone.ai. All links and the video of this episode can be found on CISO Series.com

Biden EO, Star Blizzard Using WhatsApp, Healthcare Breaches

Biden signs cybersecurity executive order Star Blizzard targeting WhatsApp US healthcare sector saw 585 breaches in 2024 Huge thanks to our sponsor, Dropzone AI What if your SOC could handle 10x the alerts without burning out your team? Dropzone AI automates Tier 1 investigations and frees your analysts to tackle bigger challenges. It's how smart teams are staying ahead. See how it worksschedule a demo today at dropzone.ai. For the stories behind the headlines, head on over to CISOSeries.com

Get Meta out of your life, GoDaddy slapped, TikTok could stay alive

How to delete Facebook, Messenger, or Instagram - if you want Meta out of your life GoDaddy slapped with wet lettuce for years of lax security and 'several major breaches' TikTok could possibly stay alive after Sunday's upcoming ban Huge thanks to our sponsor, Dropzone AI Alert fatigue is real, and it's draining. Dropzone AI takes on the tedious investigations, so you can focus on making an impact where it matters most. It's smarter tools for a smarter SOC. Check it out at dropzone.ai. For the stories behind the headlines, head on over to CISOSeries.com

Snyk's mysterious package, Baltic cable suspicions, second BeyondTrust vulnerability

Snyk mysteriously deploys apparently malicious packages Baltic sea cable cuts can't be accident, says EU tech chief CISA warns of second BeyondTrust vulnerability Huge thanks to our sponsor, Dropzone AI Does your SOC feel like it's drowning in alerts? Dropzone AI cuts through the noise, triaging 100% of alerts and giving you clear, actionable insights. Ready to break free? Check out the demo at dropzone.ai. For the stories behind the headlines, head on over to CISOSeries.com

Telefonica breach, new ransomware group leverages AI, Allstate accused of selling data

Telefonica breach exposes internal data and employee credentials New ransomware group leverages AI Allstate accused of selling consumer driving data Huge thanks to our sponsor, Dropzone AI Running a SOC is toughtoo many alerts, not enough time. Dropzone AI changes that. It reduces manual investigations by up to 90%, giving your team the bandwidth to focus on strategic threats. Imagine the impact on your operations. Visit dropzone.ai today. For the stories behind the headlines, head on over to CISOSeries.com

IRS PIN available, CISA infrastructure enrollments, Winston-Salem cyberattack

IRS Identity Protection PIN now available for filing season CISA sees enrollment surge in cyberhygiene for critical infrastructure City services in Winston-Salem affected by cyberattack Huge thanks to our sponsor, Dropzone AI Feeling buried under endless alerts? We get it. Dropzone AI takes over the grindinvestigating every alert 24/7. No more chasing false positives or wasting time on noise. It's all about clarity and focus. Ready to transform your day? Head to dropzone.ai to learn more. For the stories behind the headlines, head on over to CISOSeries.com

Week in Review: Flax Typhoon sanctioned, French military ransomware, ICAO breach claims

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Bil Harmer, operating partner and CISO, Craft Ventures Thanks to our show sponsor, Nudge Security Nudge Security helps you mitigate security risks stemming from SaaS sprawl by discovering every SaaS account ever created by anyone in your org within minutes of starting a free trial. And, you can automate on-going governance tasks like security posture checks, user access reviews, employee offboarding, and more. Start a free 14-day trial All links and the video of this episode can be found on CISO...

Worldwide Proton outage, Baymark Health breach, Treasury breach update

Proton recovers from worldwide outage BayMark Health Services announces data breach U.S. Treasury breach linked to Silk Typhoon group Huge thanks to our sponsor, Nudge Security Are you struggling to secure your exploding SaaS footprint? With Nudge Security, you can discover all SaaS apps and accounts, manage access, ensure secure configurations, vet unfamiliar tools, and automate daily identity security tasks. Start a free 14-day trial Find the stories behind the headlines at CISOseries.com.

PowerSchool hacked, Cyber Force study, EC gets GDPR fine

PowerSchool hacked Lawmakers expected to revive attempts for new Cyber Force study European Commission receives first GDPR fine Huge thanks to our sponsor, Nudge Security Nudge Security is the only solution for SaaS security and governance that can discover up to two years of historical SaaS spend along with usage insights so you can uncover wasted spend and sources of unnecessary risk. Start a free 14-day trial today

Cyber Trust label, UK deepfake laws, Treasury attack details

Cyber Trust marks to roll out in 2025 UK to criminalize sexually explicit deepfakes CISA says government hack limited to Treasury Huge thanks to our sponsor, Nudge Security Nudge Security provides advanced security posture management for Okta, Microsoft 365, and Google Workspace. With Nudge, you'll be alerted of identity security risks like weak or missing MFA, inactive admin accounts, and risky integrations, plus you can automate remediation tasks and on-going identity governance. Start a free 14-day trial today

Wallet drainer impact, U.S. telecom breach list grows, Moxa router vulnerabilities

Wallet drainer malware makes major impact U.S. telecom breach list grows Urgent warning on Moxa router vulnerabilities Huge thanks to our sponsor, Nudge Security Nudge Security discovers every GenAI tool ever used in your org, even those you've never heard of. For each tool, you'll see who introduced it, who else is using it, where it's integrated into other tools, and a vendor security profile. Get your free GenAI inventory today.

Flax Typhoon sanctions, Atos dismisses ransomware, German airport outage

U.S. sanctions China's Integrity Technology for role in Flax Typhoon attacks French military contractor Atos dismisses ransomware attack claims German airports hit by IT outage Huge thanks to our sponsor, Nudge Security Nudge Security helps you mitigate security risks stemming from SaaS sprawl by discovering every SaaS account ever created by anyone in your org within minutes of starting a free trial. And, you can automate on-going governance tasks like security posture checks, user access reviews, employee offboarding, and more. Start a free 14-day trial. Find the stories behind the headlines at CISOseries.com.

Week in Review: China hacks Treasury, Chrome extension hijack, tanker sabotages cables

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Quincy Castro, CISO, Redis Thanks to our show sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running...

China hacks Treasury, Russian tanker sabotage, Lumen ejects Typhoon

Beijing-linked hackers penetrated U.S. Treasury systems Russian tanker suspected of undersea data cable sabotage Lumen says it has locked the Salt Typhoon group out of its network Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help...

U.S. soldier arrested, Election interference sanctions, RI data leak

U.S. soldier arrested for alleged leak of Trump and Harris call logs Iranian and Russian entities sanctioned for election interference Rhode Island's health benefits data leaked Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep...

Cisco data leak, Microsoft domain transition, stories of the year

Cisco confirms data leak Microsoft announces urgent .NET domain transition Stories of the year from Cyber Security Headlines reporters Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from...

Cyberhaven extension hacked, ZAGG data breach, Volkswagen cloud leak

Cybersecurity company's Chrome extension hijacked for data theft Hackers steal ZAGG customer credit cards in third-party breach Volkswagen software company Cariad suffers Amazon cloud breach Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your...

Week in Review: Microsoft deactivation flaw, BeyondTrust on KEV, LLM generated malware

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Steve Zalewski, CISO in Residence Thanks to our show sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization...

General Dynamics phished, Japan Airlines attack, Addiction Centers breach

General Dynamics says employees targeted in phishing attack Japan Airlines systems are back to normal after cyberattack American Addiction Centers suffers data breach Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running...

Disinformation office closes, Pittsburgh Transit cyberattack, Mirai NNVR botnet

State Department's disinformation office to close after funding terminated Pittsburgh Regional Transit suffers ransomware attack Another Mirai botnet targets NVRs and TP-Link routers Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running...

Government to name witness in encrypted chat sting

Using LLMs to generate malware variants NSO liable for WhatsApp hacks OpenAI fined for privacy violations Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit ThreatLocker.com....

FlowerStorm attacks Microsoft 365, BeyondTrust on KEV, Ascension Health fallout

PaaS platform "FlowerStorm" attacking Microsoft 365 users CISA adds BeyondTrust flaw to its Known Exploited Vulnerabilities catalog Ascension Health ransomware attack impacted nearly 6 million people Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep...

Week in Review: Data breach impact study, US weighs TP-Link ban, BeyondTrust cyberattack

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Bethany De Lude, CISO, The Carlyle Group Thanks to our show sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep...

Amazon health malware, BeyondTrust suffers cyberattack, FortiNet wireless vulnerability

Android malware found on Amazon Appstore disguised as health app BeyondTrust suffers cyberattack Fortinet warns of critical flaw in Wireless LAN Manager Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently...

Interpol romance baiting, TikTok at court, TP-Link investigation

Interpol kills off Pig Butchering Supreme Court to hear TikTok ban challenge US weighs TP-Link ban Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit ThreatLocker.com....

CISA cloud directive, Texas Tech breach, Meta GDPR fine

CISA delivers new directive for securing cloud environments Texas Tech reports a data breach affecting 1.4 million people Meta fined $263 million for alleged GDPR violations Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep...

Serbian authorities use spyware, Ransomware impacts Rhode Island, ConnectOnCall breach

Serbian authorities accused of using Cellebrite to spy on journalists Ransomware attack shuts down Rhode Island's public assistance system ConnectOnCall breach exposes close to a million patients Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help...

Health chatbot exposed, credit union cyberattack, infrastructure cyberweapon attack

UnitedHealth's AI-driven insurance claims chatbot left exposed to the internet South Carolina credit union suffers cyberattack IOCONTROL cyberweapon targets infrastructure in the US and Israel Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your...

Week in Review: Salt Typhoon saga, Microsoft MFA bypass, Yahoo cuts Paranoids

Link to episode page This week's Cyber Security Headlines - Week in Review is hosted by Rich Stroffolino with guest Jimmy Sanders, president, ISSA International. ISSA International April 2025- will be celebrating its 40th Anniversary in April 2025. Watch for notifications at ISSA.org Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation...

Microsoft MFA bypass, cybercrime marketplace takedown, Sophos hacker charged

Microsoft MFA bypassed in AuthQuake attack Cybercrime marketplace Rydox taken down U.S. charges Chinese national for hacking thousands of Sophos firewall devices Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently...

Operation PowerOFF, FCC telco rules, ZLoader returns

Operation PowerOFF hits DDoS sites FCC proposes new telco cybersecurity rules ZLoader returns Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit ThreatLocker.com. For the stories...

Telecom security bill, Google's quantum chip, Chinese cyber firm sanctions

Senator announces new bill to secure telecom companies Google unveils new quantum chip U.S. sanctions Chinese cybersecurity firm for firewall hacks Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and...

Romanian energy attack, medical device disruption, Deloitte responds to data theft claims

Romanian energy giant battles ongoing attack Ransomware disrupts medical device maker Deloitte responds to data theft claims Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit...

Massachusetts hospital breach, Recall's next deployment, Blue Yonder restoration

Anna Jaques Hospital confirms details of Christmas Day ransomware breach Microsoft expands Recall preview to Intel and AMD Copilot+ PCs Blue Yonder announces restoration progress after November 21 attack Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker...

Week in Review: Cloudflare's lost logs, cyber-unsafe employees, FBI encryption request

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Sean Kelly with guest Edward Frye, head of security, Luminary Cloud. Thanks to our show sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. WithVanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews.Visit vanta.com to learn...

Feds investigate group 764, Russians hack hackers, AWS PQC migration

Feds find cybercriminal tools used by sextortion group Russian hackers hack hackers Amazon's post-quantum migration plan Huge thanks to our sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn more about Questionnaire Automation. Get the stories behind...

Phone encryption urged, Pegasus spyware discoveries, Japan I-O Data 0-day

FBI and CISA urge Americans to use encrypted apps rather than calling, iVerify scanner finds seven Pegasus spyware infections, Japan warns of IO-Data zero-day router flaws exploited in attacks Huge thanks to our sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security...

Stoli U.S. bankrupts, German Crimenetwork seized, FBI telecom advisory

Stoli files for bankruptcy in U.S. after ransomware attack Police seize largest German online criminal marketplace FBI advises telecoms to boost security following Chinese hacking campaign Huge thanks to our sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com...

Hydra Market leader sentenced, Pegasus spyware arrest, SpyLoan malware targets millions

Hydra Market leader sentenced to life Former Polish spy chief arrested in Pegasus spyware probe SpyLoan malware targets millions Huge thanks to our sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn more about Questionnaire Automation. Get...

Ransomware affiliate arrested, UK hospital hacked, Cloudflare's lost logs

Ransomware affiliate Mikhail Matveev arrested Another UK hospital system hacked Cloudflare says it lost 55% of logs pushed to customers for 3.5 hours Huge thanks to our sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn more...

Advantech WiFi flaws, T-Mobile block attack, UK hospital cyberattack

Patch alert after flaws identified in Advantech industrial Wi-Fi access points T-Mobile confirms Salt Typhoon attack was blocked UK hospital network postpones procedures after cyberattack Huge thanks to our sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your...

Interpol's African operation, Blue Yonder ransomwared, Snowflake suspect update

Interpol takes down over 1,000 cybercrime suspects in Africa Starbucks and UK grocers impacted by supply chain attack Hacker in Snowflake extortions may be a U.S. soldier Huge thanks to our sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help...

Microsoft 365 outage update, China's cyber campaign fallout, Fake IT worker scheme

Microsoft 365 outage update "Hair on Fire" over China's cyber campaign North Korean fake IT worker scheme unveiled Huge thanks to our sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware,...

DoJ seizes PopeyeTools, IGT suffers cyberattack, Windows update blocked

DoJ seizes credit card marketplace PopeyeTools Gambling giant IGT suffers cyberattack Windows update blocked on some gaming PCs Huge thanks to our sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware,...

Week in Review: Drinking water threat, CISO liability insurance, Microsoft zero-day event

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Jimmy Benoit, vp, cybersecurity, PBS Thanks to our show sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization...

MITRE's danger list, CISO liability insurance, BianLian changes tack

MITRE offers updated list of most dangerous software vulnerabilities CISOs can now obtain professional liability insurance BianLian group refines its game Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and...

Scattered Spider arrest, telcos attacked, Apple exploit

US charges Scattered Spider members Chinese threat actors infiltrate more telcos Apple issues emergency security update Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit ThreatLocker.com....

Easterly to step down, Maxar discloses breach, Microsoft hacking event

CISA director Jen Easterly to step down Space tech giant Maxar discloses employee data breach Microsoft launches Zero Day Quest hacking event Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently...

EPA warns of critical risks, Four million WordPress sites exposed, Sextortion scams bypass filters

EPA warns of critical risks in drinking water infrastructure Four million WordPress sites exposed Sextortion scams bypass Microsoft security filters Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected...

T-Mobile confirms breach, AnnieMac data stolen, NewGlove malware threat

T-Mobile confirms telecom breach hack Customer data stolen from AnnieMac New Glove infostealer malware bypasses Chrome's cookie encryption Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware,...

Week in Review: Most common passwords, Secure-by-design, DNA firm vanishes

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Brett Conlon, CISO, American Century Investments Thanks to our show sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your...

NordPass popular passwords, Healthcare extortion sentence, China breached telecoms

China threat actors breached U.S. broadband providers to spy on U.S. government officials 123456 tops the list of most popular passwords again Hacker gets 10 years in prison for U.S. healthcare extortion scheme Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn...

Volt Typhoon's new botnet, China APT hits Tibet, DoD leaker sentenced

Volt Typhoon rebuilding botnet Chinese group targets Tibetan media DoD leaker sentenced Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit ThreatLocker.com. Get the stories behind...

Giant Food cyberattack, Snowflake suspects indicted, zero-day vulnerability surge

Dutch cybersecurity incident affects Giant Food and Hannaford Indictment against Snowflake breach suspects is released Surge in zero-day vulnerability exploits is new normal, says Five Eyes Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep...

Halliburton cyberattack costs, Israel credit card DDoS, Forth announces breach

Cyberattack cost Halliburton $35 million thus far DDoS attack makes credit card readers malfunction in Israel Debt relief firm Forth announces data breach for customers and non-customers Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help...

Regulator limits phone use, Hacked police emails, UK seniors scammed

U.S. financial regulator calls for reduced cell phone use at FBI warns of spike in hacked police emails and fake subpoenas Cyberscoundrels target UK senior citizens with Winter Fuel Payment texts Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about...

Week in Review: Sophos Chinese hacker warning, AI flaws and vulnerabilities

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Ken Athanasiou, CISO, VF Corporation Thanks to our show sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn...

Interlock targets healthcare, Canada dissolves TikTok, HP critical flaws

Interlock ransomware gang aims at U.S. healthcare, IT and government Canada tells TikTok to dissolve its Canadian business Hewlett Packard warns of critical RCE flaws in Aruba Networking software Thanks to today's episode sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security...

Nokia investigates breach claims, Nigerian cybercrime bust, SelectBlinds e-skimmer breach

Nokia says it has no evidence that hackers breached company data Nigerian cybercrime bust arrests 130 people 200,000 SelectBlinds customers impacted by e-skimmer Thanks to today's episode sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn more...

ElizaRAT hits India, Washington court outage, Snowflake hacker arrested

ElizaRAT hits India IT outage impacts Washington courts Alleged Snowflake hacker arrested Thanks to today's episode sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn more about Questionnaire Automation.

Schneider Electric breached again, Russia behind fake video, Ohio's ransomware lawsuits

Schneider Electric breached for second time this year U.S. says Russia behind fake Haitian voter video Ohio's capital city faces lawsuits for handling of ransomware attack Thanks to today's episode sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com...

Entra MFA mandatory, German pharma cyberattack, LightSpy iPhone enhancements

Microsoft Entra "security defaults" to make MFA setup mandatory Ransomware attack hits German pharmaceutical wholesaler AEP Upgraded LightSpy spyware targets iPhones with more destructive power Thanks to today's episode sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visitvanta.com to learn...

Week in Review: Deepfake targets Wiz, Black Basta leverages Teams, Russia's Linux plans

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest David Cross, SVP/CISO, Oracle. Also check out David's travel blog and recent "Secure by Default" white paper at IT ISAC. Thanks to our show sponsor, Dropzone AI Security operations are evolving, and AI is leading the way. Dropzone AI autonomously investigates 100% of your alerts with precision, freeing up your team to focus on real threats. See how this works in action. Visit dropzone.ai and schedule a demo today. Add to Description: All links and the video of this episode can...

Peruvian bank heist, Task Manager error, CyberPanel vulnerabilities exploited

Peruvian bank warns of data theft after dark web revelations Windows 11 Task Manager displays wrong number of running processes CyberPanel sees vulnerabilities exploited soon after disclosure Thanks to today's episode sponsor, Dropzone AI Security operations are evolving, and AI is leading the way. Dropzone AI autonomously investigates 100% of your alerts with precision, freeing up your team to focus on real threats. See how this works in action. Visit dropzone.ai and schedule a demo today. Find the stories behind the headlines at CISOseries.com.

CISA's plan, North Korea comes to Play, FakeCall's new tricks

CISA launches International Cybersecurity Plan North Korean hackers tied to Play ransomware FakeCall learns new tricks Thanks to today's episode sponsor, Dropzone AI Tired of false positives slowing your SOC down? Dropzone AI uses advanced AI to filter out the noise and focus on real threats. 24/7, every alert, no manual intervention. Want to learn more? Schedule a demo and see the power of Dropzone AI at dropzone.ai.

Five Eyes program, Chinese activity, Russian Linux

Five Eyes launches startup security program Canada and the Netherlands seeing increased Chinese activity Russia might fork the Linux community Thanks to today's episode sponsor, Dropzone AI Facing alert overload? Dropzone AI autonomously investigates every alert, reducing noise and providing decision-ready reports. Discover how our AI solutions can enhance your SOC's efficiency. Check out our demo gallery and see how Dropzone AI works at dropzone.ai.

RedLine and Meta infostealer takedown, Russian-backed malware, French telecom breach

Global law enforcement gains access to RedLine and Meta infostealer networks Russian-backed malware poses as Ukrainian anti-recruitment tool Massive breach impacts French telecom giant Thanks to today's episode sponsor, Dropzone AI Imagine an AI analyst that never sleeps. Dropzone AI autonomously handles every alert, cutting manual analysis by 90%. It's like adding a new team member, but one that works 24/7. Experience the difference AI can make. Visit dropzone.ai to test drive the future of security operations.

Historic Change Healthcare breach, Telcom hacks investigation, Delta sues CrowdStrike

Change Healthcare data breach confirmed as largest-ever in U.S. healthcare history Authorities investigate telecom hacks following reports of campaign intrusions Delta sues CrowdStrike over sensor update that prompted mass flight disruptions Thanks to today's episode sponsor, Dropzone AI Is your SOC overwhelmed by endless alerts? Dropzone AI's autonomous SOC Analyst investigates 100% of alerts, around the clock. No playbooks, no code. Just actionable insights to reduce false positives and save your team time. Ready to see it in action? Schedule a demo today at dropzone.ai.

Week in Review: Solar Winds fines, Microsoft loses security logs, employee security awareness lacking

Link to episode page This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Dmitriy Sokolovskiy, senior vice president, information security, Semrush Thanks to our show sponsor, SpyCloud SpyCloud disrupts cybercrime by telling you what criminals know about your business, so you can take action on exposed identity data to prevent cyber attacks like ransomware. To learn more how to level the playing field against bad actors and combat cyber attacks, visit spycloud.com/headlines. All links and the video of this episode can be found on CISO Series.com

Qiliin ransomware upgrade, Sharepoint KEV flaw, Rhysida ransoms Easterseals

Researchers reveal upgraded Qilin ransomware-as-a-service CISA adds Microsoft SharePoint flaw to its KEV catalog Rhysida ransoms Easterseals Thanks to today's episode sponsor, SpyCloud Ransomware continues to impact organizations. A new report released by SpyCloud shares insights from your peers in security the majority of whom were affected by ransomware in the past year. The report has some fascinating industry-specific stats you'll want to see plus confirms some stark truths: that the industry you're in can affect your likelihood of being hit with ransomware. Check it out at spycloud.com/headlines. Find the stories behind the headlines at CISOseries.com.

CISA data rules, Fortinet zero-day, UK Cyber Essentials

CISA proposes new security requirements for personal data Fortinet patches actively exploited zero-day UK report on Cyber Essentials certification Thanks to today's episode sponsor, SpyCloud Stolen data is a hot commodity for cybercriminals. Using infostealer malware, bad actors can siphon valid session cookies from employee devices, scoring the keys to access your networks and systems. According to SpyCloud's latest research, security teams are now seeing stolen cookies among the top three entry points for initial access for ransomware. Get the full insights, including other risk factors at spycloud.com/headlines.

SolarWinds disclosure fines, Zendesk helps Internet Archive, Samsung zero-day

Four cyber companies fined for SolarWinds disclosure failures Zendesk helps Internet Archive after hacker breached email system Samsung zero-day under active exploit Thanks to today's episode sponsor, SpyCloud Researchers at SpyCloud recently found that one in five individuals was infected with infostealer malware in the last year. Unfortunately, research now confirms that infostealer infections open the door to ransomware. But organizations with visibility into identity data stolen by malware infections are better-suited to prevent a future attack. Learn more about the connection between infostealers and ransomware in SpyCloud's new report at spycloud.com/headlines.

U.S. rule on selling sensitive data, Cisco data stolen, Nidec breach

Proposed rules ban U.S. companies from selling sensitive data Cisco data stolen by IntelBroker Nidec breach exposes 50,000+ documents Thanks to today's episode sponsor, SpyCloud Did you know that infostealer malware can be a precursor to ransomware? Infostealers are a trending tactic used by cybercriminals to exfiltrate valuable identity data like credentials, PII, and session cookies. According to recent SpyCloud research, 75% of organizations were affected by ransomware more than once in the past year! Visit spycloud.com/headlines to find out how to keep your organization from becoming one of the statistics.

Microsoft logs lost, Omni Family breach, Internet Archive Zendesk breach

Microsoft warns it lost some customers' security logs for a month Omni Family Health data breach impacts almost half a million individuals Internet Archive breached again through stolen access tokens Thanks to today's episode sponsor, SpyCloud It turns out infostealer infections are a major contributing factor to a company's ransomware risk, with some industries faring better than others. Get the new research from our sponsor, SpyCloud, and see if your ransomware defense strategy stacks up against your peers. Visit spycloud.com/headlines Find the stories behind the headlines at CISOseries.com.

Week in Review: Amazon passkeys usage, healthcare ransomware stats, major cybercrime takedowns

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Steve Person, CISO, Cambia Health Thanks to our show sponsor, Conveyor It's spooky season, and nothing's scarier than all of your account execs asking if you're done with their customer security questionnaires. Don't worryConveyor is here to help. Conveyor's market leading AI automates the most time-consuming parts of customer security reviews: answering security questionnaires and sharing security docs like your SOC 2 with customers. Get instant AI answers to questionnaires and host an enterprise-grade trust center where customers can download documents...

Globe Life extortion, hacker USDoD arrested, Anonymous Sudan indicted

Insurance giant Globe Life facing extortion attempts after data theft from subsidiary Infamous hacker USDoD possibly arrested in Brazil Anonymous Sudan masterminds indicted Thanks to today's episode sponsor, Conveyor It's spooky season, and nothing's scarier than all of your account execs asking if you're done with their customer security questionnaires. Don't worryConveyor is here to help. Conveyor's market leading AI automates the most time-consuming parts of customer security reviews: answering security questionnaires and sharing security docs like your SOC 2 with customers. Get instant AI answers to questionnaires and host an enterprise-grade trust center where customers can download documents and...

AI models tested, breaking encryption, Intel security review

Putting AI models to the EU test Chinese researchers don't break classical encryption yet Chinese group calls for security reviews on all Intel products Thanks to today's episode sponsor, Conveyor There's so many reasons why infosec and presales teams choose Conveyor for automating their security reviews, but here are the main three: OneConveyor's market-leading AI provides instant, accurate answers to any format of security questionnairewithout requiring constant knowledge base updates and maintenance. TwoConveyor offers an enterprise-grade trust center that automates every customer security review request, so you're not constantly distracted with questions and SOC 2 requests. And threeConveyor's sales team....

VW alleged data theft, Finland seizes Sipultie, Calgary library cyberattack

VW says IT infrastructure unaffected after alleged data theft Finland seizes servers of 'Sipultie' dark web market Calgary Public Library services limited after cyberattack Thanks to today's episode sponsor, Conveyor Does the thought of a whopper 300 question security questionnaire in your most dreaded portal give you nightmares? Conveyor can help you sleep peacefully. How? They are the market leaders in instant and accurate AI answers to any format of security questionnaire. They even offer a zero-touch option for portal-based questionnairesjust paste the URL, and ConveyorAI automatically answers the questions and exports them back to the portal for you. End...

Pokmon game developer breached, TrickMo's new variants, Ivanti zero-days exploited

Pokmon game developer breached TrickMo hits with 40 new trojan variants Nation-state actor exploits Ivanti zero-days Thanks to today's episode sponsor, Conveyor It's spooky season, and nothing's scarier than all of your account execs asking if you're done with their customer security questionnaires. Don't worryConveyor is here to help. Conveyor's market leading AI automates the most time-consuming parts of customer security reviews: answering security questionnaires and sharing security docs like your SOC 2 with customers. Get instant AI answers to questionnaires and host an enterprise-grade trust center where customers can download documents and self-serve answers to their own questions. End...

Iran exploits Windows, Microsoft deprecates tunnels, NATO cyberexpert swap

Iranian hackers exploit Windows flaw to elevate privileges Microsoft deprecates PPTP and L2TP VPN protocols in Windows Server NATO's 'most experienced expert on cyber rotated out of cyber section Thanks to today's episode sponsor, Conveyor What's the ultimate jumpscare? That moment when the security questionnaire in the portal didn't auto-save all your work. Good news: with Conveyor, that's one horror you won't have to face. Conveyor is the market leader in instant, generative AI answers for security questionnaires, no matter the format. They even offer a zero-touch option for portal-based questionnaires where you can just paste the URL, and the...

Week in Review: Neuberger's insurance warning, instant identification sunglasses, Salt Typhoon dangers

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Quincy Castro, CISO, Redis. Thanks to our show sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn more...

Coker's Internet Security plan, hurricane scams, Firefox zero day

White House prioritizes secure internet routing, using memory safe languages Federal Trade Commission and CISA warn of hurricane-related scams Mozilla warns of Firefox zero day: patch now Huge thanks to our sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit...

Australia's cybersecurity bill, Qualcomm zero-day, Russia bans Discord

Australian Parliament introduces standalone cybersecurity law Qualcomm zero-day used to target Android devices Russia and Turkey ban Discord Huge thanks to our sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn more about Questionnaire Automation. For the...

GoldenJackal, LiteSpped Cache bug, Ukraine's milCERT

GoldenJackal uses new tools against governments Cross-site scripting flaw found in major WordPress plugin Ukraine's defense ministry launched military CERT Huge thanks to our sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn more about Questionnaire Automation....

Salt Typhoon attack, Cyberattack hits major U.S. water utility, Russia attacked on Putin's birthday

Salt Typhoon attack potentially exposes wiretap data Cyberattack hits major U.S. water utility A not- so- happy birthday present for Russia's president Huge thanks to our sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn more about...

Neuberger's Insurance suggestion, Kaspersky PlayStore removal, Detroit suffers cyberattack

Insurers should stop funding ransomware payments, says Neuberger Google removes Kaspersky antivirus software from Play Store Cyberattack hits Detroit-area government services Huge thanks to our sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn more about Questionnaire...

Week in Review: T-Mobile breach cost, Senate's deepfake scam, Public records flaws

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Jonathan Waldrop, CISO, The Weather Company. Here's a link to CISA's Cybersecurity Awareness Month announcement, sent to us by Jonathan. Thanks to our show sponsor, SpyCloud SpyCloud disrupts cybercrime by telling you what criminals know about your business, so you can take action on exposed identity data to prevent cyber attacks like ransomware. To learn more how to level the playing field against bad actors and combat cyber attacks, visit spycloud.com/headlines. All links and the video of this episode can be...

Largest DDoS blocked, Adobe Commerce compromise, neural data law

Cloudflare blocks largest recorded DDoS attack Adobe Commerce and Magento stores compromised by CosmicSting bug DOJ and Microsoft take down 107 domains used in Star Blizzard phishing attacks Huge thanks to our sponsor, SpyCloud Ransomware continues to impact organizations. A new report released by SpyCloud shares insights from your peers in security the majority of whom were affected by ransomware in the past year. The report has some fascinating industry-specific stats you'll want to see plus confirms some stark truths: that the industry you're in can affect your likelihood of being hit with ransomware. Check it out at spycloud.com/headlines. Get...

Russian cybercriminal arrests, Irish police fined, Rackspace blame game

Russian authorities arrest nearly 100 cybercriminals in raid Northern Ireland police fined for exposing officer identities Rackspace breach sparks vendor blame game Huge thanks to our sponsor, SpyCloud Stolen data is a hot commodity for cybercriminals. Using infostealer malware, bad actors can siphon valid session cookies from employee devices, scoring the keys to access your networks and systems. According to SpyCloud's latest research, security teams are now seeing stolen cookies among the top three entry points for initial access for ransomware. Get the full insights, including other risk factors at spycloud.com/headlines. Get the story behind the headlines at CISOSeries.com

LockBit ties to Evil Corp, public records flaws, ransomware hits Texas hospital

UK ties LockBit affiliate to Evil Corp Public records systems riddled with security flaws Ransomware disrupts emergency services at Texas hospital Huge thanks to our sponsor, SpyCloud Researchers at SpyCloud recently found that one in five individuals was infected with infostealer malware in the last year. Unfortunately, research now confirms that infostealer infections open the door to ransomware. But organizations with visibility into identity data stolen by malware infections are better-suited to prevent a future attack. Learn more about the connection between infostealers and ransomware in SpyCloud's new report at spycloud.com/headlines. Get the story behind the headlines at CISOSeries.com

T-mobile data breach fines, Iranian hackers charged, Deepfake scam hits U.S. senate

T-Mobile data breaches cost company $31.5 million Iranian hackers charged for targeting 2024 U.S. election Deepfake scam hits U.S. senate Huge thanks to our sponsor, SpyCloud Did you know that infostealer malware can be a precursor to ransomware? Infostealers are a trending tactic used by cybercriminals to exfiltrate valuable identity data like credentials, PII, and session cookies. According to recent SpyCloud research, 75% of organizations were affected by ransomware more than once in the past year! Visit spycloud.com/headlines to find out how to keep your organization from becoming one of the statistics. Get the story behind the headlines at CISOSeries.com

Recall redesigned again, Embargo attacks cloud, Dallas suburb cyberattack

Recall redesign: reinforced and removable Embargo moves ransomware attacks to cloud environments Dallas suburb deals with ransomware attack Huge thanks to our sponsor, SpyCloud It turns out infostealer infections are a major contributing factor to a company's ransomware risk, with some industries faring better than others. Get the new research from our sponsor, SpyCloud, and see if your ransomware defense strategy stacks up against your peers. Visit spycloud.com/headlines Get the story behind the headlines at CISOSeries.com

Week in Review: CrowdStrike exec apologizes, NIST changes password rules, corporate hack-for-hire practices

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Jason Elrod, CISO, Multicare Health System Missed the live show? Watch it on YouTube. And make sure to check out Jason's book (coming soon) at CyberCISOmarksmanship.com, as well as his newsletter at LimitlessCyber.com. And huge thanks to our sponsor Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to...

Train station WiFi hack, Mozilla tracking complaint, NIST password changes

Public Wi-Fi hacked at some of the UK's busiest train stations Data privacy watchdog files complaint against Mozilla for ad tracking feature NIST drops password complexity, mandatory reset rules Thanks to today's episode sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security...

DragonForce ransomware, Salt Typhoon hits ISPs, ChatGPT SpAIware

DragonForce uses ransomware's greatest hits Salt Typhoon strikes US ISPs Finding SpAIware on the ChatGPT Mac app Thanks to today's episode sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn more about Questionnaire Automation.

Kansas water targeted, CrowdStrike apology, MoneyGram goes dark

Kansas water plant pivots to analog after cyber event CrowdStrike exec apologizes in Congress for global IT outage MoneyGram goes offline after cyber incident Thanks to today's episode sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews. Visit vanta.com to learn...

Proposed ban on autonomous vehicles, updated Telegram policy, Necro infects Android devices

U.S. proposes ban on Chinese, Russian tech in autonomous vehicles Telegram updates policies to expose 'bad actors' Necro Trojan infects 11 million android devices through Google Play apps Thanks to today's episode sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on security reviews....

LinkedIn halts AI training, Ukraine bans Telegram, hack-for-hire lawsuit

LinkedIn halts AI data processing in UK due to privacy concerns, Ukraine bans Telegram Use for government and military, Dismissed German cyber chief falsely accused of associating with Russian spies Thanks to today's episode sponsor, Vanta As third-party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta Questionnaire Automation, security & compliance teams can complete security reviews up to 5 times faster, giving you time back to focus on running your security & compliance programs. Over 8,000 global companies like ZoomInfo, SmartRecruiters and Noibu use Vanta to save time on...

Week in Review: LinkedIn's AI chicanery, AT&T FCC settlement, Craigslist defense network

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Mike Rosen, CISO, ZwillGen, advisor to NightDragon and Villager at Team8, whose favorite story of the week was Starlink's ability to detect stealth aircraft. Check it out. Thanks to our show sponsor, Conveyor Why do teams choose Conveyor over the competition for customer security reviews? A few reasons. One. Market-leading AI accuracy for any format of security questionnaire with limited knowledge base maintenance.Two. Enterprise-grade trust center that automates every customer security request.Three. Conveyor's sales team is actually fun to work with....

INC targets healthcare, Providence schools cyberattack, Apple iPads bricked

New INC ransomware targets U.S. healthcare sector Providence public schools deal with irregular internet activity Apple pulls iPadOS 18 update that was bricking M4 iPad Pro devices Thanks to today's episode sponsor, Conveyor It's Friday and Conveyor hopes you don't have a meaty security questionnaire waiting for you on the other side of this podcast. If you do, you should check them out. As the market-leader in instant, generative AI answers to entire security questionnaires, Conveyor helps you complete questionnaires fast, no matter the format they're in, so you don't feel like you're getting crushed by the wave of unfinished...

Derailing Raptor Train, Volunteer Civil Cyber Defense, US AI safety summit

Feds derail Raptor Train Newmark creates Volunteer Network for Civil Cyber Defense US to host global AI safety summit Thanks to today's episode sponsor, Conveyor Does the next security questionnaire that hits your inbox make you want to throw your laptop out the window? If so, don't do it. You should check out Conveyor first. Conveyor is the market-leader in instant, generative AI answers to entire security questionnaires no matter the format they are in. Yes, that's right. Upload any file like excels, word docs and even PDFs for instant processing and tackle any portal-based questionnaire with a browser extension...

Exploding pager analysis, construction company vulnerability, cyberattack job loss

Exploding pager tragedy experts look towards supply chain sabotage Construction companies potentially vulnerable through accounting software Cyberattacks result in job losses Thanks to today's episode sponsor, Conveyor Are customer security reviews constantly interrupting your day? You should check out Conveyor. With an enterprise-grade trust center to securely share your security posture, SOC 2, and security FAQs and security questionnaires and market-leading AI accuracy for instant security questionnaire answers, you'll fly through any customer security request and get back to your regular job. Learn more about the AI security review automation platform your infosec friends love at www.conveyor.com. Mention this podcast...

Intellexa faces new sanctions, London hospitals impact, Apple releases update

Spyware giant Intellexa faces new U.S. sanctions Nearly 1 million impacted by ransomware attack on London hospitals Apple releases long-awaited update Thanks to today's episode sponsor, Conveyor Why do teams choose Conveyor over the competition for customer security reviews? A few reasons. One. Market-leading AI accuracy for any format of security questionnaire with limited knowledge base maintenance. Two. Enterprise-grade trust center that automates every customer security request. Three. Conveyor's sales team is actually fun to work with. Learn why Conveyor is the security review platform your infosec friends love at www.conveyor.com Get the story behind the headlines at CISOSeries.com.

Fortinet confirms breach, RansomHub extorts Kawasaki, Update: TfL password resets

Fortinet confirms customer data breach RansomHub threatens to leak stolen Kawasaki data Update: Transport for London requires in-person password resets after hack Thanks to today's episode sponsor, Conveyor Ever feel like completing security questionnaires has become your full time side hustle you're not even getting paid extra for? If so, you should check out Conveyor. Conveyor is the market-leader in instant, generative AI answers to entire security questionnaires no matter the format they are in. Yes, that's right. Upload any file like excels, word docs and even PDFs for instant processing and tackle any portal-based questionnaire with a browser extension...

Week in Review: Wisconsin Medicare MOVEit, cop sues data broker, WHOIS vulnerability

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by David Spark with guest Patrick Heim, co-founder and partner, SYN Ventures Huge thanks to our sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at vanta.com/headlines. All...

Lazarus spoofs CapitalOne, Mastercard buys RecordedFuture, WordPress imposes 2FA

Lazarus Group's VMConnect campaign spoofs CapitalOne Mastercard buys security firm Recorded Future WordPress to require two-factor authentication for plugin developers Huge thanks to our sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. That's vanta.com/headlines. Get the story behind the...

$20 WHOIS vulnerability, India's Cyber Commandos, Word hits drone makers

The $20 WHOIS vulnerability India training thousands of "cyber commandos" A Word of warnings for Taiwanese drone makers Huge thanks to our sponsor, Vanta When it comes to ensuring your company has top-notch security practices, things can get complicated, fast. Vanta automates compliance for SOC 2, ISO 27001, and more, saving you time and money. With Vanta, you can unify your security program management and proactively manage security reviews with AI-powered security questionnaires.Our listeners get $1,000 off at vanta.com/headlines. That's vanta.com/headlines. Get the story behind the headlines atCISOSeries.com

Slim CD data breach, International sextortion bust, TfL mixed messages

Slim CD notifies 1.7M customers of data breach Delaware men charged in international sextortion scheme London transit agency drops claim it has 'no evidence' of customer data theft Huge thanks to our sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at...

Payment processing breach, dark web admins charged, Predator spyware resurges

1.7 million impacted in payment processing breach Dark web administrators charged in U.S. Resurgence of Predator Spyware sparks privacy concerns Huge thanks to our sponsor, Vanta When it comes to ensuring your company has top-notch security practices, things can get complicated, fast. Vanta automates compliance for SOC 2, ISO 27001, and more, saving you time and money. With Vanta, you can unify your security program management and proactively manage security reviews with AI-powered security questionnaires.Our listeners get $1,000 off at vanta.com/headlines. That's vanta.com/headlines. Get the story behind the headlines atCISOSeries.com

Avis rentals breach, Microsoft disables ActiveX, Wisconsin Medicare breach

Car rental company Avis discloses data breach Microsoft Office 2024 to disable ActiveX controls by default Wisconsin Medicare users had information leaked in MOVEit breach Huge thanks to our sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. Get the...

Week in Review: MFA bypass bust, Airport security SQL, GitHub help malware

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Justin Somaini, partner, YL Ventures Thanks to our show sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. All links and the video of this episode can be found on CISO Series.com

Planned Parenthood cyberattack, DoJ propaganda takedown, Microchip Technology theft

Planned Parenthood suffers cyberattack DoJ propaganda domains takedown Microchip Technology confirms data theft Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. Find the stories behind the headlines at CISOseries.com.

Spyware research, Cicada rebrand, MacroPack malware

Spyware research report They found a way to make Cicadas more annoying MacroPack red teaming tool used for malware Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io.

Halliburton data stolen, Columbus sues researcher, White House protects internet

Halliburton confirms data stolen in cyberattack City of Columbus sues researcher after ransomware attack White House publishes plan to protect a key component of the internet Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. For the stories behind the headlines, visit CISOseries.com.

London transport cyberattack, German ATC attack, Sweden's heightened risk

Transport for London suffers cyberattack German air traffic control agency confirms cyberattack Sweden warns of heightened risk of Russian sabotage Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. Find the stories behind the headlines at CISOseries.com

Seattle airport woes, aircraft cockpit SQL, North Korea's FudModule

Seattle Airport issues travelers' advisory for Labor Day travel SQL injection able to bypass airport TSA security checks North Korea uses FudModule Rootkit in Chrome zero-day exploit Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. Find the stories behind the headlines at CISOseries.com.

DICK'S Sporting Goods cyberattack, Brain Cipher hacked Paris

DICK'S Sporting Goods suffers cyberattack Brain Cipher claims attack on Paris museums, promises data leak Play ransomware hackers claim attack on Microchip Technology Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. Find the stories behind the headlines at CISOSeries.com

Iran hacking, Labour Party backlog, more Telegram warrants

Iran targeting presidential administration officials Iran working with ransomware gangs UK Labour Party chided over cyberattack backlog Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. Find the stories behind the headlines at CISOSeries.com

Another MOVEit incident, U.S. Marshals disputes breach, Park'N Fly data swiped

Texas credit union user data exposed in another MOVEit breach US Marshals Service disputes ransomware gang's breach claims Park'N Fly notifies 1 million customers of data breach Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. Find the stories behind the headlines at CISOSeries.com

SonicWall access flaw, Microsoft security summit, Telegram details

SonicWall warns of critical access control flaw Microsoft to host security summit More details on Telegram CEO's arrest Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. Find the stories behind the headlines at CISOSeries.com

Halliburton suffers cyberattack, Telegram CEO arrested, Georgia Tech lawsuit

Halliburton takes systems offline following cyberattack French police arrest Telegram CEO Pavel Durov DOJ joins suit against Georgia Tech over Defense Department cybersecurity failures Thanks to today's episode sponsor, Scrut Automation Scrut Automation allows compliance and risk teams of any size to establish enterprise-grade security programs. Their best-in-class features like process automation, AI, and over 75 native integrations reverse compliance debt and help manage risk proactively as your business grows. Visit scrut.io to schedule a demo or learn more. That's www.scrut.io. Find the stories behind the headlines at CISOSeries.com

Week in Review: NPD breach update, Hawaii hacker sentenced, Poisoned LLM coders

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Bethany De Lude, CISO, The Carlyle Group Thanks to today's episode sponsor, Nudge Security When your CEO asks "Hey, are we using that SaaS app that was just breached?", how quickly and confidently can you answer? Stop guessing with Nudge Security. Discover all SaaS accounts ever introduced by anyone in your org, in minutes and get alerted when any SaaS app used in your org is breached. Start a 14-day trial now at nudgesecurity.com/saas All links and the video of this...

Russia's questionable DDoS, FAA's cybersecurity proposal, Windows Recall reappears

Kremlin complains of DDoS attack, digital experts not so sure FAA proposes new cybersecurity rules for airplanes Windows Recall to reappear Thanks to today's episode sponsor, Nudge Security Do you know who's using genAI tools in your org? Find out today withNudge Security. Their patented approach to SaaS discovery gives you a full inventory of all apps ever introduced by anyone in your org, in minutes, including genAI apps. And, automated workflows help you scale security and governance without breaking a sweat. Start a free trial today atnudgesecurity.com/genai For the stories behind the headlines, head to CISOseries.com.

Japanese auto security, Feds tap encrypted messages, Microsoft breaks Linux dual-booting

Security initiative from Japanese auto companies Feds tapping into encrypted messaging haul Microsoft breaks Linux dual-boot systems Thanks to today's episode sponsor, Nudge Security How big is your SaaS attack surface? Find out today with Nudge Security. Nudge Security discovers all SaaS accounts ever created by anyone in your org, in minutes, and gives you automated workflows to scale SaaS security and governance. Take control of your SaaS security posture. Start a free trial today atnudgesecurity.com/cisoseries

Toyota third-party breach, Hawaii registry hack, Iran disrupting campaigns

Toyota confirms third-party data breach impacting customers Man who hacked Hawaii state registry sentenced U.S. Intelligence blames Iran for Trump campaign hack Thanks to today's episode sponsor, Nudge Security When your CEO asks "Hey, are we using that SaaS app that was just breached?", how quickly and confidently can you answer? Stop guessing with Nudge Security. Discover all SaaS accounts ever introduced by anyone in your org, in minutes and get alerted when any SaaS app used in your org is breached. Start a 14-day trial now at nudgesecurity.com/saas For the stories behind the headlines, visit CISOseries.com.

National Public Data breach update, Flaws in macOS apps, FlightTracker configuration issue

'Only' 1.3 million affected by National Public Data Breach Flaws in Microsoft macOS Apps allowing secret recording Configuration issue exposes flight tracking site Thanks to today's episode sponsor, Nudge Security Do you know who's using genAI tools in your org? Find out today with Nudge Security. Their patented approach to SaaS discovery gives you a full inventory of all apps ever introduced by anyone in your org, in minutes, including genAI apps. And, automated workflows help you scale security and governance without breaking a sweat. Start a free trial today at nudgesecurity.com/genai

Entra forces MFA, another AnyDesk heist, Google Pixel vulnerability

Microsoft Entra admins must enable MFA or lose access to admin portals Cybercrime gang uses fake Windows update screen to hide data theft Google Pixel devices shipped with vulnerable Verizon app Thanks to today's episode sponsor, Nudge Security How big is your SaaS attack surface? Find out today with Nudge Security. Nudge Security discovers all SaaS accounts ever created by anyone in your org, in minutes, and gives you automated workflows to scale SaaS security and governance. Take control of your SaaS security posture. Start a free trial today at nudgesecurity.com/cisoseries For the stories behind the headlines, head to CISOseries.com.

Week in Review: NIST encryption standards, NPD breach analyzed, Texas sues GM

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Edwin Covert, head of cyber risk engineering, Bowhead Specialty Underwriters and edwincovert.com Thanks to our show sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about...

GitHub artifact warning, RansomHub's EDR killer, SolarWinds latest hotfix

GitHub vulnerability warning regarding ArtiPacked RansomHub affiliate launches new EDR-killing tool SolarWinds issues hotfix for web help desk vulnerability Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from...

Gemini AI privacy, AI Risk Repository, Russian phishing

Google details privacy commitments with Gemini AI MIT releases AI Risk Repository Russian spies using highly targeted phishing Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware,...

FBI shutters Radar, NIST post-quantum standards, 2.7B record leaked

FBI shutters Radar ransomware gangs servers NIST finalizes post-quantum encryption standards 2.7 billion National Public Data records leaked Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware,...

U.S. "laptop farm" shut down, Ukranian computers compromised, Trump campaign hacked

U.S. operation of "laptop farm" for North Korea shutdown Over 100 Ukrainian government computers compromised Trump campaign says they were hacked Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and...

Iran election interference, AMD SinkClose flaw, ADT break-in

Iranian hackers ramping up U.S. election interference AMD SinkClose flaw helps install nearly undetectable malware ADT discloses breach that impacts more than 30,000 customers demands Thanks to today's episode sponsor, ThreatLocker Do zero-day exploits and supply chain attacks keep you up at night? Worry no more; you can harden your security with ThreatLocker. ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team. To learn more about how ThreatLocker can help keep your...

Week in Review: CrowdStrike releases Falcon, ransomware as terrorist threat

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest DJ Schleen, distinguished security architect, Yahoo Thanks to our show sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. That's vanta.com/headlines....

Chameleon malware reappears, Rhysida hospital attack, Blacksuit's $500m tally

Chameleon reappears targeting Canadian restaurant chain Rhysida claims attack on Bayhealth Hospital in Delaware BlackSuit/Royal achieves $500m in ransomware demands Huge thanks to our sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. That's vanta.com/headlines. For the stories behind the...

McLaren hospitals disrupted, CrowdStrike improves processes, Ronin Network hacked

McLaren hospitals disruption linked to INC ransomware attack CrowdStrike to give customers control over Falcon sensor updates Ronin Network hacked by "white hats" Huge thanks to our sponsor, Vanta When it comes to ensuring your company has top-notch security practices, things can get complicated, fast. Vanta automates compliance for SOC 2, ISO 27001, and more, saving you time and money. With Vanta, you can unify your security program management and proactively manage security reviews with AI-powered security questionnaires.Our listeners get $1,000 off at vanta.com/headlines. That's vanta.com/headlines

Android kernel zero-day, voter portal flaw, ransomware as terrorism

Google patches Android kernel zero-day Researchers find flaws in Georgia voter portal Law would make ransomware a terrorist threat Huge thanks to our sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. That's vanta.com/headlines.

CrowdStrike strikes back against Delta, Keytronic loses millions to ransomware, Flaw in Apache OFBiz

CrowdStrike strikes back against Delta's claims of negligence Ransomware attack costs Keytronic $17 million Patch required for high-severity flaw in Apache OFBiz Huge thanks to our sponsor, Vanta When it comes to ensuring your company has top-notch security practices, things can get complicated, fast. Vanta automates compliance for SOC 2, ISO 27001, and more, saving you time and money. With Vanta, you can unify your security program management and proactively manage security reviews with AI-powered security questionnaires.Our listeners get $1,000 off at vanta.com/headlines. That's vanta.com/headlines

Software update malware, investors sue CrowdStrike, cybercriminals in prisoner swap

Hackers use ISP to send malware through software updates CrowdStrike sued by investors following update failure Historic prisoner swap includes cybercriminals returned to Russia Huge thanks to our sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. That's vanta.com/headlines. For...

Week in Review: CrowdStrike problems grow, record breaking ransom, Argentina's Minority Report

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Dennis Pickett, vp, CISO, Westat Thanks to our show sponsor, Dropzone AI Dropzone AI's Analyst investigates alerts with unmatched speed and precision, providing clear, actionable reports. Experience the power of autonomous threat detection. Meet Dropzone AI at BSides Las Vegas. Visit dropzone.ai for a 3-month free trial. All links and the video of this episode can be found on CISO Series.com

Cencora patient breach, OneDrive phishing campaign, Argentina's crime predictions

Cencora confirms patient data stolen in February cyberattack Phishing campaign targets OneDrive users Argentina will use AI to predict future crimes Huge thanks to our sponsor, Dropzone AI Picture an analyst who works tirelessly around the clock. Dropzone AI's Analyst investigates every alert and provides comprehensive, actionable reports. Boost your SOC's capabilities with a 3-month free trial at dropzone.ai. For the stories behind the headlines, head to CISOseries.com

Elections and DDoS, dating apps leak locations, Germany blames China

DDoS attacks won't impact US elections Dating apps leaked precise location data Germany formally blames China for 2021 cyberattack Huge thanks to our sponsor, Dropzone AI Think of Alex, your new team member who never takes a break. Dropzone AI's Analyst investigates every alert and delivers detailed reports without playbooks or code. Experience Alex's dedication with a 3-month free trial at dropzone.ai.

Delta's legal maneuver, Record-breaking ransom, Meta $1.4B settlement

Delta enlists Microsoft's legal nemesis over CrowdStrike losses Dark Angels receives record-breaking ransom payment Meta to pay $1.4 billion biometric lawsuit Huge thanks to our sponsor, Dropzone AI Dropzone AI's Analyst investigates alerts and responds to threats with unmatched speed and precision. No playbooks, no code required. Transform your SOC's performance with a 3-month free trial at dropzone.ai. For the stories behind the headlines, head to CISOseries.com.

HealthEquity data breach, CrowdStrike impact grows, Proofpoint exploit

4.3 million impacted by HealthEquity data breach Microsoft admits CrowdStrike incident far greater than first reported Proofpoint exploit allows for millions of fake emails Huge thanks to our sponsor, Dropzone AI Imagine an analyst who never misses an alert. Dropzone AI autonomously investigates every alert and provides decision-ready reports, enhancing your SOC's efficiency. Try it free for 3 months at dropzone.ai.

PyPi package targets MacOS, Columbus, Ohio suffers cyber incident, Windows July update problems

Hackers exploiting PyPi package targets MacOS Columbus, Ohio suffers cyber incident Windows July updates come with some BitLocker and remote connectivity challenges Huge thanks to our sponsor, Dropzone AI Meet Dropzone AI, the analyst who never rests. Investigating every alert with unparalleled speed and precision, delivering clear, actionable reports. No playbooks, no code. Experience the power of AI with a 3-month free trial at dropzone.ai. For the stories behind the headlines, head to CISOseries.com.

Week in Review: CrowdStrike developments, LA court shutdown, MGM casino claims win

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Jana Moore, CISO, Belron, also vice president, EmpoWer Supporting women in infosec. Thanks to our show sponsor, Vanta When it comes to ensuring your company has top-notch security practices, things can get complicated, fast. Vanta automates compliance for SOC 2, ISO 27001, and more, saving you time and money. With Vanta, you can unify your security program management and proactively manage security reviews with AI-powered security questionnaires. Our listeners get $1,000 off at Vanta dot com/headlines. All links and the video...

Microsoft Defender exploited, assassin's encryption frustration, NK elite hackers

Hackers exploiting Microsoft Defender SmartScreen bug IT leaders note increase in severity of cyber-attacks, ransomware and BEC stand out, Trump shooting investigation revives the end-to-end encryption issue Huge thanks to our sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines....

CrowdStrike details, Chrome keeps cookies, BreachForums leaked

CrowdStrike dishes details Google scuttles third-party cookie deprecation BreachForums leaked on Telegram Huge thanks to our sponsor, Vanta When it comes to ensuring your company has top-notch security practices, things can get complicated, fast. Vanta automates compliance for SOC 2, ISO 27001, and more, saving you time and money. With Vanta, you can unify your security program management and proactively manage security reviews with AI-powered security questionnaires. Our listeners get $1,000 off at vanta.com/headlines.

Wiz deal crumbles, CrowdStrike aftermath, dYdX exchange hack

Google's $23 billion plan to buy Wiz falls apart U.S. government looking for answers amidst CrowdStrike aftermath dYdX exchange hacked in DNS hijack attack Thanks to our episode sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. For the stories...

CrowdStrike update, Russian criminals sanctioned, ransomware shuts down courts

CrowdStrike says "significant number" back up and running Russian cyber criminals sanctioned for infrastructure attacks Ransomware attack shuts down largest trial court in U.S. Huge thanks to our sponsor, Vanta When it comes to ensuring your company has top-notch security practices, things can get complicated, fast. Vanta automates compliance for SOC 2, ISO 27001, and more, saving you time and money. With Vanta, you can unify your security program management and proactively manage security reviews with AI-powered security questionnaires. Our listeners get $1,000 off at vanta.com/headlines.

CrowdStrike hits Cloud PCs, criminals exploit CrowdStrike fix, CISA rebuked

Microsoft confirms CrowdStrike update also hit cloud Windows PCs Cybercriminals exploit CrowdStrike problem to distribute malware CISA adds some big names to its KEV catalog Huge thanks to our sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. For the...

Week in Review: Crowdstrike Microsoft outage, AT&T breach implications, CDK pays up

Link to blog post get exact one from https://cisoseries.com This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Adam Arellano, former vp, enterprise cybersecurity, PayPal Thanks to our show sponsor, Conveyor Why do teams choose Conveyor over the competition to automate answering security questionnaires? A few reasons. One. Market-leading AI accuracy Two. They don't have to maintain a crazy knowledge base anymore because ConveyorAI can read from any source like external support sites, documents, past questionnaires and more. Three. It can process ANY customer file format even PDFs! It will even auto-scroll and auto-complete...

Windows outage, Fin7 sells malware, Synnovis blood shortage

Windows outage worldwide UK national blood stocks suffer the effects of ransomware Security flaws in SAP AI Core cloud-based platform Thanks to today's episode sponsor, Conveyor It's Friday and Conveyor hopes you don't have a meaty security questionnaire waiting for you on the other side of this podcast. If you do, you should check them out. As the market leader in instant, generative AI answers to entire security questionnaires, Conveyor helps you complete questionnaires fast, no matter the format they're in, so you don't feel like you're getting crushed by the wave of unfinished work. Learn why we're the software...

UK ransomware reporting, Project Oscar, ransoms spike

UK mandatory ransomware reporting gets watered-down Google introduces AI agent to look for software bugs Critical infrastructure ransomware costs spike Thanks to today's episode sponsor, Conveyor Does the anticipation of the next monster security questionnaire wrecking your day ever make you feel like a balloon floating above a cactus field? If so, you should check out Conveyor. Conveyor is the market-leader in instant, generative AI answers to entire security questionnaires no matter the format they are in. Yes, that's right. Upload any file like Excel, Word docs and even PDFs for instant processing and tackle any portal-based questionnaire with a...

Rite Aid update, AT&T ransom laundered, Hacktivists leak Disney data

Rite Aid says 'limited' cybersecurity incident affected over 2 million people AT&T ransom laundered through mixers and gambling services Hacktivists leak Disney data to protect artist rights Thanks to today's episode sponsor, Conveyor Why do teams choose Conveyor over the competition to automate answering security questionnaires? A few reasons. One. Market-leading AI accuracy Two. They don't have to maintain a crazy knowledge base anymore because ConveyorAI can read from any source like external support sites, documents, past questionnaires and more. Three. It can process ANY customer file format - even PDFs! It will even auto-scroll and auto-complete portal-based questionnaires. Don't...

Wiz acquisition, AT&T paid hacker, Squarespace domain defaults

Alphabet in talks to acquire Wiz AT&T allegedly paid hacker to delete data Details on Squarespace domain hacks Thanks to today's episode sponsor, Conveyor Does the mountain of security questionnaires in your inbox make you feel like you're in a rowboat trying to make it through a tsunami? If so, you should check out Conveyor. As the market leader in instant, generative AI answers to entire security questionnaires, Conveyor helps you complete them fast, no matter the format they're in, and never feel like you're getting crushed by the wave of unfinished work. Learn more about the AI security review...

Rite Aid breach, AT&T breach implications, CDK paid ransom

Rite Aid announces data breach following June cyberattack The personal security implications of the AT&T breach US offers support to prevent Paris Olympics cyber and disinformation attacks Thanks to today's episode sponsor, Conveyor Ever feel like completing security questionnaires has become your full-time side hustle you're not even getting paid extra for? If so, you should check out Conveyor. Conveyor is the market leader in instant, generative AI answers to entire security questionnaires no matter the format they are in. Yes, that's right. Upload any file like Excel, Word docs and even PDFs for instant processing and tackle any portal-based...

Week in Review: AT&T breach, Security regulations attacked, 10 billion passwords stolen

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Andrew Cannata, CISO, Primo Water Thanks to our show sponsor, Entro Security What are you doing to secure your company's non-human identities? Vaults and scanners are helpful, but they don't give the context for where your secrets are, how they're being used, or when it's time to remove or rotate them. The entro platform provides automated lifecycle management and seamless integration, ensuring comprehensive security & compliance through a unified and easy to use interface. All links and the video of this...

PHP vulnerability exploit, Auto Parts breach, dark patterns report

PHP vulnerability exploited, spreading malware and DDoS attacks Advance Auto Parts reveals damage from Snowflake breach FTC report reveals dark patterns used to trick consumers Thanks to today's episode sponsor, Entro Reclaim control over your Non-human identities! Entro enables security teams to manage and secure the lifecycle of non-human identities and secrets from inception to rotation. Think of it like an airtag for your secrets - know where they are, how they're being used, and their risk level in one seamless platform. Visit https://entro.security/ to learn more. For the stories behind the headlines, head to CISOseries.com.

Australia targets foreign tech, banks sunset OTP, Veeam vulnerability exploited

Australia targets government tech under foreign control Singapore banks replace OTP with digital tokens New group targets Veeam vulnerability Thanks to today's episode sponsor, Entro What are you doing to secure your company's non-human identities? Vaults and scanners are helpful, but they don't give the context for where your secrets are, how they're being used, or when it's time to remove or rotate them. The entro platform provides automated lifecycle management and seamless integration, ensuring comprehensive security & compliance through a unified and easy to use interface. Visit https://entro.security/ to learn more.

Russian bot takedown, Burdensome cyber regs, Fujitsu data exposed

US disrupts Russian AI-powered disinformation bot farm Senate takes aim at 'overly burdensome' cybersecurity regs Fujitsu confirms customer data exposed in cyberattack Thanks to today's episode sponsor, Entro Reclaim control over your Non-human identities! With Entro, security teams can now manage and secure the lifecycle of Non-human identities and secrets. Like an air tag for your non-human identities, The entro platform provides automated lifecycle management and seamless integration, ensuring comprehensive security & compliance through a unified and easy to use interface. Visit https://entro.security/ to learn more. For the stories behind the headlines, visit CISOseries.com.

Billions of stolen passwords, cybersecurity regulations even trickier, Apple removes popular apps

Record-breaking 10 billion stolen passwords exposed Supreme court ruling makes cybersecurity regulations even trickier Apple removes popular apps at Russia's request Thanks to today's episode sponsor, Entro Did you know that an attack on non-human identities and secrets is one of the top 2 cyber attack vectors out there ? With Entro, security teams can now manage and secure the lifecycle of Non-human identities and secrets. The entro platform provides automated lifecycle management and seamless integration, ensuring comprehensive security & compliance through a unified and easy to use interface. Visit https://entro.security/ to learn more.

Alabama Education breach, OpenAI secrets breach, Florida Health breach

Alabama Department of Education suffers data breach New York Times claims hackers stole OpenAI secrets in a 2023 security breach RansomHub claims to have published Florida health department data Thanks to today's episode sponsor, Entro Reclaim control over your Non-human identities! Entro enables security teams to manage and secure the lifecycle of non-human identities and secrets from inception to rotation. Think of it like an airtag for your secrets - know where they are, how they're being used, and their risk level in one seamless platform. Visit https://entro.security/ to learn more. For the stories behind the headlines, head to CISOseries.com.

Senator pressures CISA, Velvet Ant exploits Cisco, Europol crushes Cobalt

Senate leader demands answers from CISA re March Ivanti hack China's Velvet Ant hackers exploiting new Cisco zero-day Europol law enforcement takes down Cobalt Strike servers Huge thanks to our sponsor, Demoed Buyers do 70% of their product research before talking to a company. That blew our minds. Why not give buyers as much information about your product as possible to help them decide? Eliminating friction has always been key to a solid sales strategy. With Demoed, buyers can research faster and more effectively. Sign up at demoed.com For the stories behind the headlines, head to CISOseries.com.

Evolve breach update, Patelco cyberattack, LockBit claims Croatian cyberattack

Evolve Bank data breach is evolving Patelco Credit Union cyberattack disrupts services for nearly 500,000 members LockBit claims cyberattack on Croatia's largest hospital Huge thanks to our sponsor, Demoed Did you know that Demoed is the first platform that allows you to watch a live product demo and ask questions without receiving a barrage of follow-ups? We change buyer-vendor engagement: fewer follow-ups for buyers, more leads for vendors. Sign up now at demoed.com For the stories behind the headlines, visit CISOseries.com.

14 million Linux systems threatened, Critical patch for Juniper routers, Millions impacted by Prudential breach

14 million Linux systems threatened by 'RegreSSHion' vulnerability Critical patch issued for Juniper routers Millions not thousands impacted by Prudential breach Huge thanks to our sponsor, Demoed "I have extra time in my day" is something no security professional has ever said. Vendors on Demoed host 15-minute pitches highlighting their value and differentiation. Demoed allows buyers to browse and get educated without sales pressurewindow shopping for enterprise sales. Sign up now at demoed.com

TeamViewer breach update, HubSpot customer attacks, Cyber insurance problems

Update on the TeamViewer network breach HubSpot looks into customer account hacks U.S. businesses struggle to obtain cyber insurance Huge thanks to our sponsor, Demoed Demoed is a unique platform that connects buyers and sellers. Buyers want to see more products, and vendors want more leads. Demoed solves this for both by making buyers anonymous. Buyers can watch demos without follow-ups, hiding their identity until they are ready. Sign up now at demoed.com. For the stories behind the headlines, head to CISOseries.com.

Week in Review: CDK Blacksuit developments, Criminal nuclear failures. U.S. Kaspersky ban

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Jim Bowie, CISO, Tampa General Hospital Thanks to our show sponsor, Prelude Security When executives ask the question, are we vulnerable to this threat? How long does it take you to get a confident answer? Prelude automatically transforms threat intelligence into validated detections, so you can know with certainty in just a manner of minutes. Visit preludesecurity.com/threats to upload your own threat intelligence and see for yourself. All links and the video of this episode can be found on CISO Series.com

Gas chromatograph vulnerabilities, Cloudflare rebukes Polyfill, Evolve Bank breach

Gas chromatograph vulnerabilities reveal medical IoT challenges We never authorized polyfill.io to use our name, says Cloudflare Evolve Bank confirms data breach, undermining LockBit's Federal Reserve claim Huge thanks to our sponsor, Prelude Security When executives ask the question, are we vulnerable to this threat? How long does it take you to get a confident answer? Prelude automatically transforms threat intelligence into validated detections, so you can know with certainty in just a manner of minutes. Visit preludesecurity.com to upload your own threat intelligence and see for yourself. For the stories behind the headlines, head to CISOseries.com.

Snowblind Android, identity services leaks data, Polyfill.io supply chain attack

Android lying Snowblind in the sun Identity verification service exposed data for over a year Polyfill.io JavaScript attack impacts thousands of sites Huge thanks to our sponsor, Prelude Security 30 minutes to peace of mind. That's what you'll get with Prelude's automated threat management platform where you can upload any piece of threat intelligence and quickly generate threat-hunting queries, detection rules, and more. Visit preludesecurity.com and get all of this in 30 minutes or get a pizza on Prelude.

Julian Assange plea, Latest MOVEit bug, Neiman Marcus data sale

Julian Assange to plead guilty and return to Australia Fresh MOVEit bug under attack just hours after disclosure Criminal selling Neiman Marcus customer info for $150K Huge thanks to our sponsor, Prelude Security Don't be left wondering if you're protected the next time a new threat hits the news. Week in review listeners can upload their threat intelligence to Prelude and receive a free bundle of relevant detection rules, hunt queries, and security tests. Any piece of threat intelligence. All in 30 minutes. Upload yours at prelude security dot com forward slash threats.

Indonesia battles Lockbit, DOJ charges cybercrime group, SEC reports following CDK Global attack

Indonesia battles Lockbit 3.0 ransomware DOJ charges cybercrime group for $71 million in damages SEC reports pile in following CDK Global attack Huge thanks to our sponsor, Prelude Security What would your security teams do with more time back in their day? Prelude provides an end-to-end threat management automation platform that quickly generates hunt queries, detection rules, and security tests from your threat intelligence to help you stay ahead of threats. Upload your own threat intelligence at preludesecurity.com and get all of that in just 30 minutes or less.

BlackSuit behind CDK, Microsoft spoofing bug, Nuclear compliance failures

CDK Global outage caused by BlackSuit ransomware attack Bug allows Microsoft corporate email account spoofing UK's largest nuclear site pleads guilty over cybersecurity failures Huge thanks to our sponsor, Prelude Security When executives ask the question, are we vulnerable to this threat? How long does it take you to get a confident answer? Prelude automatically transforms threat intelligence into validated detections, so you can know with certainty in just a manner of minutes. Visit preludesecurity.com to upload your own threat intelligence and see for yourself. For the stories behind the headlines, head to CISOseries.com.

Week in Review: Breach restoration breached, Vermont privacy debate, Qilin blames victims, posts data

Link to blog post This week's Cyber Security Headlines - Week in Review is hosted by Rich Stroffolino with guest Bil Harmer, operating partner and CISO, Craft Ventures, also at wilharm3.com. Thanks to our show sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security Our listeners get...

CDK Global hacked again, LockBit activity, Kraken extorted for bug bounty

CDK Global gets hacked twice LockBit Activity on the rise Kraken extorted by security researcher Thanks to today's episode sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines.

Nvidia most valuable, Markopolo's meeting infostealer, Medibank MFA blame

Nvidia becomes world's most valuable company Markopolo scam delivers infostealer through fake meeting software Medibank hack blamed on MFA failure Thanks to today's episode sponsor, Vanta When it comes to ensuring your company has top-notch security practices, things can get complicated, fast. Vanta automates compliance for SOC 2, ISO 27001, and more, saving you time and money. With Vanta, you can unify your security program management and proactively manage security reviews with AI-powered security questionnaires.Our listeners get $1,000 off at vanta.com/headlines. For the stories behind the headlines, head to CISOseries.com.

AMD investigates breach, Qilin demands ransom, Hackers derail Amtrak

AMD investigates breach after data for sale on hacking forum Qilin demands $50 million ransom from UK hospital Hackers derail Amtrak Guest Rewards accounts Thanks to today's episode sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. For the stories...

Snowflake breach escalates, MITRE has a memo for the president, Velvet Ant persists

Snowflake breach escalates with ransom demands and death threats MITRE has a memo for the president Velvet Ant maintains three-year cyber espionage campaign Thanks to today's episode sponsor, Vanta When it comes to ensuring your company has top-notch security practices, things can get complicated, fast. Vanta automates compliance for SOC 2, ISO 27001, and more, saving you time and money. With Vanta, you can unify your security program management and proactively manage security reviews with AI-powered security questionnaires.Our listeners get $1,000 off at vanta.com/headlines.

CISA tabletop exercise, Keytronic confirms breach, Linux emoji malware

CISA leads first tabletop exercise for AI cybersecurity Keytronic confirms data breach after ransomware gang leaks stolen files New Linux malware controlled through Discord emojis Thanks to today's episode sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. For the...

Week in Review: New York Times theft, Club Penguin hack, NHS wants blood

Link to blog post This week's Cyber Security Headlines Week in Review is hosted byRich Stroffolino with guest Janet Heins, CISO, ChenMed and janetheins.com Thanks to our show sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off atVanta.com/headlines. All links and the...

Cyberinsurance claims increase, NATO's Russia vigilance, Remcos RAT phishing

Record high for North American cyber insurance claims NATO members to increase vigilance over Russian sabotage attempts Remcos RAT discovered inside UUEncoding emails Thanks to today's episode sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. For the stories behind...

Life360 faces extortion attempt, White House reports increase in federal attacks, Black Basta exploits zero-day flaw in windows

Life360 faces extortion attempt after Tile data breach White House report highlights increase in federal attacks Russian hacker with ties to LockBit and Conti gangs arrested Thanks to today's episode sponsor, Vanta When it comes to ensuring your company has top-notch security practices, things can get complicated, fast. Vanta automates compliance for SOC 2, ISO 27001, and more, saving you time and money. With Vanta, you can unify your security program management and proactively manage security reviews with AI-powered security questionnaires.Our listeners get $1,000 off at vanta.com/headlines.

Snowflake hack update, BreachForums down again, Cylance data for sale

Pure Storage hacked via Snowflake workspace BreachForums down again and official Telegram channels deleted BlackBerry Cylance data up for sale Thanks to today's episode sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. For the stories behind the headlines, visit...

Rural hospital support, 23andMe investigation, Snowflake breach notices

Cyber assistance coming to rural hospitals UK and Canada launch investigation into 23andMe breach Mandiant and Snowflake sending out breach notices Thanks to today's episode sponsor, Vanta When it comes to ensuring your company has top-notch security practices, things can get complicated, fast. Vanta automates compliance for SOC 2, ISO 27001, and more, saving you time and money. With Vanta, you can unify your security program management and proactively manage security reviews with AI-powered security questionnaires.Our listeners get $1,000 off at vanta.com/headlines.

Microsoft resets Recall, LastPass outage update, New York Times breach

Microsoft resets Recall plans LastPass says outage caused by bad Chrome extension update New York Times source code stolen using exposed GitHub token Thanks to today's episode sponsor, Vanta Whether you're starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing Trust Center. Over 7,000 global companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security. Our listeners get $1,000 off at Vanta.com/headlines. For the stories behind...

Week in Review: CopIlot Recall disaster, Ticketmaster hack fallout, ChangeHealthcare notification change

Link to blog post This week's Cyber Security Headlines - Week in Review is hosted by Rich Stroffolino with guest Andrew Wilder, CISO, Community Veterinary Partners, also cybersecurityintheboardroom.com. Thanks to our show sponsor, Conveyor Why did the AI cross the road? To complete your security questionnaires for you. Conveyor, the company using market-leading AI to automate the entire security review, wants you to check them out and book a call so they can stop writing these cheesy podcast ads. If you're ready for AI to instantly complete security questionnaires for you, visit www.conveyor.com to try a free proof of concept....

FCC moves forward with BGP security, LockBit victims get lifeline, Gitloker attacks target GitHub repositories

FCC moves forward with BGP security measures LockBit ransomware gang victims get lifeline from FBI Gitloker attacks target GitHub repositories Thanks to today's episode sponsor, Conveyor Why did the AI cross the road? To complete your security questionnaires for you. Conveyor, the company using market-leading AI to automate the entire security review, wants you to check them out and book a call so they can stop writing these cheesy podcast ads. If you're ready for AI to instantly complete security questionnaires for you, visit www.conveyor.com to try a free proof of concept. Mention this podcast for 5 free questionnaire credits...

Psychology vs. threat actors, AI leveling up, Qilin hit Synnovis

US researches using psychology against threat actors AI leveling up unsophisticated threat actors London Hospital attacks linked to Qilin Thanks to today's episode sponsor, Conveyor Conveyor is the market leading AI-powered platform that automates the entire customer security review process from easily sharing your security posture and SOC 2 to letting AI answer security questionnaires instantly with 90% accuracy. Use Conveyor to fly through any customer security review in minutes. There's a reason our customers have dubbed Conveyor their 'favorite security tool of the year'. Test it out in a free proof of concept at www.conveyor.com and mention this podcast...

London hospitals hit by ransomware, Christie's stolen data sold, RansomHub claims Frontier breach

Ransomware attack forces London hospitals to cancel operations Christie's stolen data sold to highest bidder RansomHub claims responsibility for Frontier breach Thanks to today's episode sponsor, Conveyor Conveyor is the AI security review automation platform helping infosec teams automate everything from securely sharing a SOC 2 to one-click auto complete of your security questionnaires with AI. Teams like Lucid Software are finding in a free proof of concept that our AI is more accurate than the rest. Learn more at www.conveyor.com. Mention this podcast for 5 free questionnaire credits when you purchase a Pro plan.

Russian criminals unmasked, Background check firm breach, Creds added to HIBP

Authorities unmask criminals behind malware loaders 3 billion records stolen from background check firm Creds for 361 million accounts added to HIBP Thanks to today's episode sponsor, Conveyor What are infosec teams measuring these days? More often than not, their impact on the business through revenue. A director of GRC told us the most direct value for their CEO was showing the efficiencies and the dollars that security has been able to bring in from enabling sales through the security review. See how best in class infosec teams measure their performance in Conveyor's ultimate guide to the security review KPIs...

Ticketmaster breached, Ticketek Australia breached, HHS notification change

Ticketmaster hack affects 560 million customers, third-party denied liability Australia's Ticketek sees customer details exposed in cyber security breach HHS changes tack, allows Change Healthcare to file breach notifications for others Thanks to today's episode sponsor, Conveyor Conveyor, the market-leading AI software for answering security questionnaires and securely sharing your security documents just released their ultimate guide to benchmarking your team's performance on customer security reviews. Get all of the detailed metrics and learn how best in class infosec teams measure and tie their impact to revenue. Download the report at www.conveyor.com by clicking on the banner at the top....

Week in Review: Arc launch sabotaged, Cencora health breach, BlackBasta's oil hit

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Dimitri Van Zantvliet, CISO, Dutch Railways Thanks to our show sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for...

UnitedHealth responsibility, Europol dropper takedown, malware bricks routers

Senator calls for UnitedHealth leadership to be held responsible Europol seizes 2,000 domains in dropper takedown Malware bricked over 600,000 routers Thanks to today's episode sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for you. Visit vanta.com/ciso to...

New NK hackers, Dutch bank breached, Wayback Machine attacked

New North Korean hacking group emerges Dutch bank ABN Amro discloses data breach Internet Archive, including Wayback Machine, impacted by DDoS Thanks to today's episode sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for you. Visit vanta.com/ciso to...

BreachForums returns, First American data breach, Chinese nationals sanctioned

BreachForums returns just weeks after FBI-led takedown First American data breach impacts 44,000 people Chinese nationals sanctioned for botnet that stole 'billions' in COVID-19 relief funds Thanks to today's episode sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass...

Ransomware uses BitLocker, pharmacy supplier breach, ATM malware threat

New ransomware uses Windows BitLocker to encrypt victim data Sav-Rx discloses data breach impacting 2.8 million Americans New ATM malware poses significant global threat Thanks to today's episode sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for you....

Arc browser sabotaged, Cencora pharma breach, Albany County breach

Arc browser's Windows launch sabotaged by malvertising Cencora breach exposed patient info from 11 drug companies Albany County investigating cybersecurity breach ahead of holiday weekend Thanks to today's episode sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for...

Week in Review: Healthcare admin breach, China and Rockwell fallout, Military cyber service

Link to blog post This week's Cyber Security Headlines - Week in Review is hosted by Rich Stroffolino with guest Mike Lockhart, CISO, EagleView. Make sure also to check out Mike's charity, the Grady Foundation for mental, physical and economic health. You can learn more and donate here. Thanks to our show sponsor, Tines Break away from traditional SOAR with Tines. Trusted by security teams at McKesson, Canva, and Mars, Tines is scalable and accessible for the whole team. Use Tines to automate security team toil, enrich alerts with data from across your tech stack, and foster a culture of...

Chinese hack military, Search engine outage, Mattis speaks out

Chinese hackers hide on military and government networks for 6 years Microsoft outage affects Bing, Copilot, DuckDuckGo and ChatGPT internet search Mattis speaks out against separate military cyber service Thanks to today's episode sponsor, Tines Break away from traditional SOAR with Tines. Trusted by security teams at McKesson, Canva, and Mars, Tines is scalable and accessible for the whole team. Use Tines to automate security team toil, enrich alerts with data from across your tech stack, and foster a culture of cybersecurity. Start building for free at tines.com/ciso For the stories behind the headlines, head to CISOseries.com.

NY Stock Exchange owner fined, $50 million towards hospital security, LockBit no longer reigns supreme

NY Stock Exchange owner fined $10 million by SEC US agency pledges $50 Million to automate hospital security LockBit no longer reigns supreme Thanks to today's episode sponsor, Tines Digital threats evolve rapidly, making it difficult for security teams to keep pace. Tines security automation is different from traditional SOAR -- it allows teams to move faster and make better decisions in real-time. Built by security practitioners, for security practitioners, Tines powers mission-critical security workflows at McKesson, Canva, and Mars. Start building for free at tines.com/ciso

UK ransomware reporting, Tech Against Scams, secure Windows 11 defaults

Brits to propose mandatory ransomware reporting Industry heavyweights launch Tech Against Scams Microsoft targets secure defaults in Windows 11 Thanks to today's episode sponsor, Tines Automate the toil with SOAR that actually works for your team. With Tines, your whole team can build complex workflows, without having to write or manage code. Security teams at McKesson, Canva, and Mars use Tines to build, run, and monitor their most important workflows, from endpoint detection and response, to vulnerability management. Start building for free at tines.com/ciso

Cyber service amendment, GetCaught abuses services, chatbot jailbreaks

Military cyber service proposal picks up steam Threat actors abusing legitimate services in campaign Chatbots susceptible to jailbreaks Thanks to today's episode sponsor, Tines Security teams work best when all members are empowered to do their best work. With Tines, analysts and engineers have everything they need to automate the processes they're closest to. The result? Hundreds or even thousands of hours that can be used on more impactful work. Built by security practitioners, for security practitioners. Get started today at tines.com/ciso

Grandoreiro Trojan reappears, Kimsuky's new backdoor, More healthcare breaches

Grandoreiro banking Trojan reappears, hits banks worldwide Kimsuky deploys new backdoor in latest attack on South Korea Healthcare breaches in Australia and Texas Huge thanks to this week's episode sponsor, Tines From endpoint detection and response to vulnerability management, Tines empowers security teams to automate even their most complex workflows. It's fast, flexible, and secure by design. Your team can get up and running in minutes, not weeks. No code. No custom development. The world's smartest security teams trust Tines to support their mission-critical processes. Learn why at tines.com/ciso For the stories behind the headlines, head to CISOseries.com.

Week in Review: Okta chief speaks, Volt typhoon threat, FBI siezes BreachForums

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Ryan Bachman, evp and global CISO, GM Financial Thanks to our show sponsor, vanta.com/ciso Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first...

Nissan NA breach, VMware Pwn2Own fix, GE Ultrasound flaws

Nissan North America breach impacts over 53,000 employees VMware fixes workstation flaws, thanks Pwn2Own hackers Security flaws discovered in GE Ultrasound machines Thanks to today's episode sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for you. Visit vanta.com/ciso...

FBI seized BreachForums, Android threat detection, US AI investment

FBI seizes BreachForums Android getting live threat detection Senators recommend billions for AI investments Editor's note: post updated to fix audio issue Thanks to today's episode sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for you. Visit vanta.com/ciso...

Singing River breach, D-Link exploit released, Google AI spots scams

Singing River patient data was swiped in ransomware attack PoC exploit released for D-Link router zero-day Google to use GenAI to help identify phone scams Thanks to today's episode sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for...

FCC implements new classification, MITRE releases embedded devices framework, World renowned auction house attacked

FCC implements new classification to combat robocall groups MITRE releases threat-modeling framework for embedded devices World renowned auction house attacked ahead of mega-auction Thanks to today's episode sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for you. Visit...

Boeing confirms ransomware, Dell announces breach, Ascension Healthcare attacked

Boeing confirms $200 million ransomware extortion attempt Dell announces data breach affecting 49 million customers Ascension healthcare suffers cyberattack, goes offline Thanks to today's episode sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for you. Visit vanta.com/ciso to...

Week in Review: Neuberger's operational approach, LockBit is back, Fed's DMARC warning

Link to blog post This week's Cyber Security Headlines Week in Review is hosted by Rich Stroffolino with guest Sasha Pereira, CISO, WASH Thanks to our show sponsor, Vanta.com/ciso Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for you. Visitvanta.com/ciso...

F5 Big-IP warning, UK Army breach, BetterHelp pays out

F5 Networks warns of new Big-IP vulnerabilities UK armed forces' personal data hacked in MoD breach BetterHelp sends refund notices regarding data sharing lawsuit Huge thanks to our sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for you....

Lockbit hit Wichita, AI export bans, Pathfinder on Intel

Lockbit takes credit for Wichita attack US looks at AI model export bans The Spectre of Pathfinder haunts Intel CPUs Huge thanks to our sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for you. Visit vanta.com/ciso to take...

LockBit ringleader indicted, DocGo cyberattack, UK military data compromise

US indicts LockBit ransomware ringleader DocGo discloses cyberattack that compromised patient health data Payroll data breach exposed data of UK military personnel Huge thanks to our sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for you. Visit vanta.com/ciso...

LockBit's website is back, Germany takes action amid alleged Russian attack, Chinese-linked ArcaneDoor targets infrastructure

LockBit's website is back Germany takes action amid alleged Russian attack Chinese-linked ArcaneDoor targets global network infrastructure Huge thanks to our sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first pass for you. Visit vanta.com/ciso to take a tour.

Neuberger proposes improvements, Olympic cybersecurity preparations, Microsoft VPN warning

NSC's Neuberger suggests operational approach for on mitigating cyberattacks French cybersecurity teams prepare for "unprecedented" Olympic threat Feds warn about North Korean exploitation of improperly configured DMARC Huge thanks to our sponsor, Vanta Are lengthy security reviews pulling attention away from your security program? With the largest network of Trust Centers, Vanta can help you streamline security reviews to win customer trust, save time, and close deals fast. Proactively demonstrate security by showcasing key resources like your SOC 2 or ISO 27001 and provide real-time evidence for passing controls. And when a security questionnaire is required, Vanta takes the first...

Week in Review: Dropbox Sign breach, Cybersecurity consultant arrested, Ukraine Microsoft hack

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestPhil Beyer, former CISO, Etsy Thanks to today's episode sponsor, Dropzone.ai Dropzone.ai's AI Autonomous Analyst is transforming cybersecurity as we know it. By replicating the techniques of elite analysts and autonomously investigating every alert, our patented system force multiplies your SOC team by 10X without adding headcount. Experience the future of threat detection and response atdropzone.ai. Request a trial today! All links and the video of this episode can be found on CISO Series.com

Goldoon exploits D-Link, CISA GitLab warning, Dropbox Sign breach

Goldoon botnet exploits D-Link routers CISA adds Gitlab flaw to its KEV catalog Dropbox discloses breach of digital signature service Thanks to our episode sponsor, Dropzone AI Dropzone.ai's AI Autonomous Analyst is transforming cybersecurity as we know it. By replicating the techniques of elite analysts and autonomously investigating every alert, our patented system force multiplies your SOC team by 10X without adding headcount. Experience the future of threat detection and response at dropzone.ai. Request a trial today! For the stories behind the headlines, head to CISOseries.com.

Chinese disinformation, NCSC AMS, new State Secrets law

Chinese disinformation proving ineffectual NCSC release Advanced Mobile Solutions risk model China implements new State Secrets Law Thanks to our episode sponsor, Dropzone AI Cybersecurity leaders, are you being asked to leverage the power of Gen AI in your SOC? Dropzone.ai's AI Autonomous Analyst empowers your team to thoroughly investigate every alert. No playbooks, no code, just intelligent, adaptable alert investigation. Test drive on dropzone.ai to immediately see the results for yourself.

UnitedHealth Group CEO faces congress, U.S. wireless carriers face majors fine, Marriott backtracks protection claims

UnitedHealth Group CEO faces congress & cause of hack revealed Major U.S. wireless carriers face $200M FCC fine Marriott backtracks claims of encryption protection Thanks to our episode sponsor, Dropzone AI Dropzone.ai is proud to announce our selection as a Top 10 Finalist for the prestigious RSA Innovation Sandbox. Our AI Autonomous Analyst is revolutionizing the way SOC teams operate, replicating the techniques of elite analysts and autonomously investigating every alert. Meet us at RSAC and book a time at dropzone.ai.

USPS phishing, UK IoT law, industrial USB attacks

USPS phishing sites are popular UK bans bad IoT credentials USB malware attacks targeting industrial sites Thanks to our episode sponsor, Dropzone AI Attention cybersecurity professionals! Are you investigating 100% of the alerts from your IT and security systems? Dropzone.ai's AI Analyst autonomously investigates every alert without playbooks or code, enabling you to turn over every rock. Visit dropzone.ai to learn more and request a trial. Offload your tier-1 analysis to an AI analyst that never sleeps so you can.

Kaiser Permanente breach, DSH Safety Board, Okta stuffing attack

Kaiser Permanente website tracking tools may have compromised customer data DHS announces AI safety board Okta warns of "unprecedented" credential stuffing attacks on customers Thanks to our episode sponsor, Dropzone AI Introducing Dropzone.ai, the industry's first AI Autonomous SOC Analyst. Their patented LLM replicates the techniques of elite analysts, autonomously investigating every alert without playbooks or code. Force multiply your SOC team by 10X without adding headcount. Visit dropzone.ai to request a trial and experience the power of AI-driven cybersecurity. For the stories behind the headlines, head to CISOseries.com.

Week in Review: GitHub comments abused, networkless" attack techniques, Police bodycam AI reports

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestChristina Shannon, CIO,KIK Consumer Products Thanks to our show sponsor, Veracode Get ready to experience the future of application security at RSAC 2024 withVeracode. Join us as we unveil cutting-edge innovations and insights to tackle today's most pressing security challenges. From live demos showcasing our newest products to engaging discussions with industry experts. See you at RSAC! All links and the video of this episode can be found on CISO Series.com

Google postpones cookies, Brocade vulnerability warning, ICICI card gaffe

Google postpones third-party cookie deprecation Brocade SAN appliances and switches exposed to hacking ICICI Bank exposes credit cards to wrong users Thanks to this week's episode sponsor, Veracode Don't miss out on this opportunity to elevate your cybersecurity strategy. Build and scale secure software from code to cloud with speed and trust. Visit our booth #2045 at RSAC 2024 to discover how Veracode is shaping the future of Application Security in the AI era. For the stories behind the headlines, head to CISOseries.com.

Chinese keyboard flaws, hacked news story, TikTok on the clock

Chinese keyboard app flaws exposed Threat actors plant fake assassination story ByteDance on the clock to divest TikTok Thanks to this week's episode sponsor, Veracode Research reveals AI-generated code mirrors human-written code's security flaws. Even seasoned programmers struggle to spot errors, with incorrect AI-generated answers abound. Veracode knows the stakes. While AI accelerates coding, relying on hunches won't suffice. Trust multi-faceted, data-driven insights to mitigate risk from the start. Don't compromise on security. Choose Veracode, your security partner in the AI-driven era of development.

Iranian hackers charged, Siemens fixing Palo bug, Russia hacks water plant

Iranian nationals charged with hacking U.S. companies and agencies Siemens working to fix device affected by Palo Alto firewall bug Russian hackers claim cyberattack on Indiana water plant Thanks to this week's episode sponsor, Veracode Are you truly listening to both your security and development teams? Make informed decisions with Veracode. Our developer-friendly security tools integrate with your existing tech stack to secure code from the start. Bridge the gap between security and development for more efficient operations and stronger defenses. Visit veracode.com for a collaborative approach to security. For the stories behind the headlines, visit CISOseries.com.

TikTok ban update, Sandworm hits Ukraine, North Korean streaming animators

TikTok ban passes the US House Sandworm targets critical Ukrainian orgs North Koreans animating streaming shows Thanks to this week's episode sponsor, Veracode AI coding companions assist in generating high-quality code snippets, while Veracode swoops in to conduct thorough security assessments, identifying and fixing vulnerabilities quickly. With this dynamic duo, developers can innovate with confidence, knowing their code is both efficient and secure. Secure more code with Co-Pilot or any AI coding companion and Veracode. We'll be your wingman anytime.

RedLine GitHub connection, MITRE Ivanti breach, E-ZPass spoof sites

RedLine stealer GitHub connection MITRE's breached was through Ivanti zero-day vulnerabilities Researchers find dozens of fake E-ZPass toll websites following FBI warning Thanks to this week's episode sponsor, Veracode Imagine your intelligent coding companion, backed by the robust security expertise of Veracode. Together, we form the ultimate duo, empowering developers to write better code while ensuring it's secure from the get-go. Learn more at RSAC 2024 with Veracode. For the stories behind the headlines, head to CISOseries.com

Week in Review: Cisco MFA breach, Bad bots surge, Microsoft mail breach fallout

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestDan Walsh, CISO,Paxos Thanks to our show sponsor, Conveyor Happy Friday! Are you tired of hearing about Conveyor's AI security review automation software? We'll stop talking about it if you book a call. Ready to give the market leading AI for security questionnaires a spin? Try a free proof of concept at www.conveyor.com. Don't forget to mention this podcast for 5 free questionnaire credits when you purchase a Pro plan. All links and the video of this episode can be found on CISO Series.com

LabHost police bust, Michigan healthcare attack, Windows Fibers vulnerability

Police bust reveals sophisticated phishing-as-a-service platform Overlooked Windows Fibers offer handy route for malicious payload deployment Michigan healthcare organization suffers data breach Thanks to today's episode sponsor, Conveyor Happy Friday! Are you tired of hearing about Conveyor's AI security review automation software? We'll stop talking about it if you book a call. Ready to give the market leading AI for security questionnaires a spin? Try a free proof of concept at www.conveyor.com. Don't forget to mention this podcast for 5 free questionnaire credits when you purchase a Pro plan. For the stories behind the headlines, head to CISOseries.com.

Water utility threats, GPT-4 hacking, SIM swap solicitation

Sandworm-linked group tied to attack on water utilities GPT-4 reads security advisories Cell carrier workers solicited for SIM swaps Thanks to today's episode sponsor, Conveyor Conveyor is the market leading AI-powered platform that automates the entire customer security review process from sharing your security posture and SOC 2 in a single portal to using that same information to automate answering security questionnaires with 90% accuracy. Use Conveyor to fly through any customer security review in minutes. It might sound like every other software claim out there, but there's a reason our customers have dubbed Conveyor their 'favorite security tool of...

Cisco MFA breach, Bad Bots surge, LockBit 3.0 propagates

Cisco announces breach of multifactor authentication message provider Bad bots drive 10% annual surge in account takeover attacks LockBit 3.0 variant generates custom, self-propagating malware Thanks to today's episode sponsor, Conveyor Conveyor is the AI security review automation platform helping infosec teams automate everything from securely sharing a SOC 2 to one-click autofilling security questionnaires with AI so you can spend almost zero time on the manual tasks that make you want to cry into your laptop. Teams like Lucid Software are finding in a free proof of concept that our AI is better than the rest. Learn more at...

Threads out in Turkey, Palo Alto backdoor, Microsoft' security overhaul

Meta to close Threads in Turkey Palo Alto fixes backdoor zero-day Details on Microsoft's security overhaul Thanks to today's episode sponsor, Conveyor What are infosec teams measuring these days? More often than not, their impact on sales. As infosec teams become hands on in the sales cycle, proving your value becomes key. A director of GRC said last week that the most direct value for their CEO was showing the efficiencies and the dollars that security has been able to bring in from enabling sales. See these trends and more in Conveyor's '2024 State of the Security Review" report at...

U.S. surveillance reauthorization, Roku breach update, Microsoft breach exposed agencies

House passes reauthorization of U.S. surveillance program Roku says 576,000 accounts compromised in latest security breach Microsoft breach exposed federal agencies Thanks to today's episode sponsor, Conveyor It's Conveyor again, the market-leading AI software for answering security questionnaires and securely sharing your security posture and documents. Conveyor's 'State of the Security Review" report for 2024 was just released and it's all about what the "new era" of infosec holds. Learn how positioning security and compliance early in the sales cycles increases win rates by 42% and what infosec teams need to prepare for as they move closer to the sales...

Week in Review: Government hospital warning, Sisence breach, Financial firms lose $12b

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestMike Levin, deputy CISO,3M Thanks to our show sponsor, Vanta When it comes to ensuring your company has top-notch security practices, things can get complicated fast. WithVanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA. Even more, Vanta's market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires. Over 7,000 fast-growing companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and...

Palo Alto patches, CISA's Sisense warning, GitHub repos gamed

Palo Alto Networks fixes several DoS vulnerabilities in PAN-OS operating system Sisense breach exposes customers to potential supply chain attack Threat actors gaming GitHub Search Thanks to today's episode sponsor, Vanta The average security pro spends nearly a full workday every week just on compliance. With Vanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA. Even more, Vanta's market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires. Over 7,000 fast-growing companies like Atlassian, Flo Health, and Quora...

CISA malware analysis, "hunt forward" missions, Spectre v2

CISA expands automated malware analysis US Cyber Command launched "hunt forward" missions Spectre v2: Linux Boogaloo CHECK OUT Capture the CISO season 2 here. Thanks to today's episode sponsor, Vanta The average security pro spends nearly a full workday every week just on compliance. With Vanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA. Even more, Vanta's market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires. Over 7,000 fast-growing companies like Atlassian, Flo Health, and Quora use...

Ukraine cyber head suspended, LG TV vulns, Microsoft exposed passwords

Ukraine's head of cybersecurity suspended and assigned to combat zone Over 90,000 LG Smart TVs exposed to remote attack Microsoft exposed internal passwords in security lapse Thanks to today's episode sponsor, Vanta The average security pro spends nearly a full workday every week just on compliance. With Vanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA. Even more, Vanta's market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires. Over 7,000 fast-growing companies like Atlassian, Flo Health, and...

Cyberattack impacts vet firm, data privacy bill movement, DOJ hack exposes thousands

Cyberattack causes major disruptions for UK vet firm Data privacy bill pushes forward with bipartisan support Department of Justice hack exposes hundreds of thousands Thanks to today's episode sponsor, Vanta The average security pro spends nearly a full workday every week just on compliance. With Vanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA. Even more, Vanta's market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires. Over 7,000 fast-growing companies like Atlassian, Flo Health, and Quora use...

Hospital hack warning, Five Eyes follow-up, NYC municipal hack

Government warns hospitals of hackers targeting IT help desks U.S. government contractor Acuity responds to alleged Five Eyes breach New York City becomes latest in municipal government hack attempts Thanks to today's episode sponsor, Vanta The average security pro spends nearly a full workday every week just on compliance. With Vanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA. Even more, Vanta's market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires. Over 7,000 fast-growing companies like Atlassian,...

Week in Review: Five Eyes breach, Microsoft's Chinese hack response, AT&T customer breach

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byDavid Sparkwith guestSteve Gentry, Advisor,Clari Thanks to our show sponsor, Vanta The average security pro spends nearly a full workday every week just on compliance. With Vanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA. Even more, Vanta's market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires. Over 7,000 fast-growing companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security...

Five Eyes breach, cancer center breach, Pixel zero-day flaw

Classified Five Eyes data theft announced Cancer center data breach affects 800,000 Android Pixel phone zero-day flaws being exploited by forensic companies Thanks to today's episode sponsor, Vanta The average security pro spends nearly a full workday every week just on compliance. With Vanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA. Even more, Vanta's market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires. Over 7,000 fast-growing companies like Atlassian, Flo Health, and Quora use Vanta to...

Microsoft security failings, NIST NVD backlog, Chrome DBSC beta

Report criticizes Microsoft's Chinese hack response NIST needs help with vulnerability backlog Chrome tests feature to prevent session hijacking Thanks to today's episode sponsor, Vanta The average security pro spends nearly a full workday every week just on compliance. With Vanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA. Even more, Vanta's market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires. Over 7,000 fast-growing companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and...

Cyber incident reporting rule, Google blocks spoofed emails, PandaBuy breach

CISA releases draft rule for cyber incident reporting Google now blocks spoofed emails for better phishing protection Breach at online shopping platform PandaBuy affects 1.3 million customers Thanks to today's episode sponsor, Vanta The average security pro spends nearly a full workday every week just on compliance. With Vanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA. Even more, Vanta's market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires. Over 7,000 fast-growing companies like Atlassian, Flo Health,...

Incognito settlement, hallucinated software, phone protocols vulnerable

Google to delete Incognito tracking data Hallucinated software packages as a security vulnerability FCC investigating phone infrastructure security Thanks to today's episode sponsor, Vanta The average security pro spends nearly a full workday every week just on compliance. With Vanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA. Even more, Vanta's market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires. Over 7,000 fast-growing companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove...

AT&T data leak, Linux backdoor discovery, DHS phone data policy

Data of 73 million AT&T customers leaked on dark web Accidental Linux backdoor discovery likely prevented thousands of infections DHS expected to stop buying access to your phone info Thanks to today's episode sponsor, Vanta The average security pro spends nearly a full workday every week just on compliance. With Vanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA. Even more, Vanta's market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires. Over 7,000 fast-growing companies like Atlassian,...

Week in Review: Spyware boosts zero-days, MFA bombing targets Apple, Facebook snooped Snapchat

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestYaron Levi, CISO,Dolby, andsageinsights.io Thanks to our show sponsor, Varonis Ready to reduce your risk without taking any? Try Varonis' free data risk assessment. It takes minutes to set up and in 24 hours you'll have a clear, risk-based view of the data that matters most and a clear path to automated remediation. Get started for free today at varonis.com/cisoseries. All links and the video of this episode can be found on CISO Series.com

17 billion records exposed, Treasury FinSec warning, Hot Topic attacks

17 billion personal records exposed in data breaches in 2023 U.S. Treasury warns financial sector about AI cybersecurity threats Retail chain Hot Topic hit by new credential stuffing attacks Thanks to today's episode sponsor, Varonis Ready to reduce your risk without taking any? Try Varonis' free data risk assessment. It takes minutes to set up and in 24 hours you'll have a clear, risk-based view of the data that matters most and a clear path to automated remediation. Get started for free today at varonis.com/cisoseries. For the stories behind the headlines, head to CISOseries.com.

Zero-day rise, SharePoint vulnerability, Facebook sniffs app traffic

Spyware fuels rise in zero-day exploits CISA warns about Microsoft SharePoint vulnerability Facebook snooped on encrypted Snapchat traffic Thanks to today's episode sponsor, Varonis Ready to reduce your risk without taking any? Try Varonis' free data risk assessment. It takes minutes to set up and in 24 hours you'll have a clear, risk-based view of the data that matters most and a clear path to automated remediation. Get started for free today at varonis.com/cisoseries.

APT31 targets families, UK newspaper attacked, Apple MFA bombing

APT31 targeting family members to surveil targets Ransomware gang attacks UK newspaper supporting the homeless MFA bombing attacks target Apple users Thanks to today's episode sponsor, Varonis Ready to reduce your risk without taking any? Try Varonis' free data risk assessment. It takes minutes to set up and in 24 hours you'll have a clear, risk-based view of the data that matters most and a clear path to automated remediation. Get started for free today at varonis.com/cisoseries. For the stories behind the headlines, visitCISOseries.com.

EU targets tech giants, China bans US tech, US cyber force

EU targets tech giants with DMA China starts US tech ban in government Think tank calls for US military cyber service Thanks to today's episode sponsor, Varonis Ready to reduce your risk without taking any? Try Varonis' free data risk assessment. It takes minutes to set up and in 24 hours you'll have a clear, risk-based view of the data that matters most and a clear path to automated remediation. Get started for free today at varonis.com/cisoseries.

New Kimsuky technique, KDE Linux warning, Atlassian critical flaws

Kimsuky turns to compiled HTML Help files for cyberattacks KDE issues warning after theme wipes Linux user's files Critical flaw in Atlassian Bamboo data center and server must be fixed immediately Thanks to today's episode sponsor, Varonis Ready to reduce your risk without taking any? Try Varonis' free data risk assessment. It takes minutes to set up and in 24 hours you'll have a clear, risk-based view of the data that matters most and a clear path to automated remediation. Get started for free today at varonis.com/cisoseries. For the stories behind the headlines, head to CISOseries.com.

Week in Review: McDonald's outage explained, SIM swap fraud, spyware agreement support

Link to blog post This week'sCyber Security Headlines Week in Review, is hosted byRich Stroffolinowith guest Gerald Auger Ph.D., Chief Content Creator,Simply Cyber Thanks to our show sponsor, Vanta Managing the requirements for modern security programs is increasingly challenging. Vanta's trust management platform helps you quickly assess risk, streamline security reviews, and automate compliance for SOC 2, ISO 27001, HIPAA, and more. Plus, you can save time by completing security questionnaires with Vanta AI. Join over 7,000 global companies that use Vanta to automate evidence collection, unify risk management, and secure customer trust. To learn more, go to vanta.com/ciso All...

Microsoft Server crashes, npm package discrepancies, Nemesis marketplace raided

Microsoft confirms Windows Server issue behind domain controller crashes Over 800 npm packages found with discrepancies Nemesis darknet marketplace raided in Germany-led operation Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to...

Water task force, Loop DoS attacks, GitHub vulnerability fixer

US plans Water Sector Cybersecurity Task Force Loop DoS attack exploits the infinite regress of UDP GitHub tool uses AI to fix vulnerabilities Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to...

Mid-stream ESports hack, System glitch costs millions, LockBit reemerges with vengeance

Mid-stream hack postpones ESports league Bank loses $40 million after "systems glitch" LockBit reemerges with vengeance Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and watch their 3-minute product demo.

Change Healthcare payout, FTC probe into Reddit, Japanese tech giant breached

UnitedHealth fronts over $2 billion in recovery efforts Spyware agreement gains more international support FTC probes Reddit's AI data licensing ahead of IPO Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to...

McDonald's outage update, Chrome URL protection, Birmingham Alabama outage

Global McDonald's outage blamed on third-party vendor, not cyberattack Google adds real-Time URL protection for Chrome Network outages hit Birmingham Alabama Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and...

Week in Review: Russian Microsoft exfiltration, JetBrains Rapid7 feud, Change Healthcare fallout

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestAlexandra Landegger, Executive Director and CISOCollins Aerospace Thanks to our show sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and...

Change Healthcare fallout, Fortinet SQL warning, Yacht company breach

Change Healthcare - AHA asks for aid, HHS questions HIPAA compliance Fortinet warns of severe SQLi vulnerability in FortiClientEMS software Yacht company MarineMax announces cyberattack Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more,...

Gemini vulnerabilities, NYT-OpenAI drama, GitHub leak report

Researchers find vulnerabilities in Gemini New York Times denies it "hacked" OpenAI for lawsuit Leaked GitHub secrets up 28% Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and watch their...

LockBit claims hack, CISA understaffed, US and Russia election concerns

LockBit takes credit for hacking South African pension fund CISA's OT attack response team understaffed US and Russia accuse each other of potential election cyberattacks Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more,...

Roku forces reset, French agencies targeted, Fintech firm taken offline

Roku forces reset after 15,000 accounts compromised French government agencies targeted in "unprecedented" attacks Fintech firm taken offline by ransomware attack Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and...

Microsoft breach update, CISA flags JetBrains, ChatGPT creds sale

Microsoft says Russian hackers breached its systems, accessed source code CISA adds JetBrains TeamCity bug to its KEV catalog Over 225,000 compromised ChatGPT credentials for sale Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn...

Week in Review: German Webex gaffe, Google engineer indicted, Cloudflare's AI firewall

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestDavid Cross, SVP/CISO,Oracle. Also check out David's travel blog, DavidCrossTravels.com Thanks to our show sponsor, Conveyor Conveyor is the AI security review automation platform helping infosec teams automate everything from securely sharing a SOC 2 to one-click autofilling security questionnaires in OneTrust so you can spend almost zero time on the manual tasks that make you want to throw your computer out the window. Teams are finding in a free proof of concept that our AI is better than the rest. Learn more atwww.conveyor.com. Mention this...

FlipperZero attacks Teslas, Google engineer indicted, PetSmart attack warning

Flipper Zero WiFi attack can unlock and steal Tesla cars Former Google engineer indicted for stealing AI secrets for Chinese companies PetSmart warns customers of credential stuffing attack Thanks to today's episode sponsor, Conveyor Conveyor is the AI security review automation platform helping infosec teams automate everything from securely sharing a SOC 2 to one-click autofilling security questionnaires in OneTrust so you can spend almost zero time on the manual tasks that make you want to throw your computer out the window. Teams are finding in a free proof of concept that our AI is better than the rest. Learn...

Online fraud hits record losses, states urge Meta to crack down on scammers, Apple issues update for zero-day flaw

Online fraud hits record losses States urge Meta to crack down on scammers Apple issues update for zero-day flaw Thanks to today's episode sponsor, Conveyor Happy Thursday. Are you tired of us talking about how Conveyor's AI security review automation software? We'll stop talking about it if you come talk to them. Ready to give the market leading AI for security questionnaires a spin? Try a free proof of concept at www.conveyor.com. Don't forget to mention this podcast for 5 free questionnaire credits when you purchase an Enterprise plan. For the stories behind the headlines, head to CISOseries.com.

US cyber strategy update, spyware sanctions, ALPHV exits

US cybersecurity strategy update on the way US Treasury issues first spyware sanctions UK denies responsibility for ALPHV takedown Thanks to today's episode sponsor, Conveyor Conveyor is the only GPT-powered customer trust portal that automates the entire customer security review process from sharing your security posture and documents in a single portal to automating security questionnaire responses with 90% accuracy so you can fly through any customer security review in minutes. It might sound like every other compliance software claim out there, but there's a reason our customers have dubbed Conveyor their 'favorite security tool of the year'. Test our...

North Korea semiconductor hacks, ALPHV goes dark, China AI vouchers

North Korea targets semiconductor industry ALPHV infrastructure goes dark China to offer computing vouchers to AI startups Thanks to today's episode sponsor, Conveyor AI is getting pretty smart so you shouldn't settle for mediocre security questionnaire automation software that only generates the right answer 20 to 50 percent of the time or have to wait a day for the vendor's team to check the answers. Conveyor's security questionnaire automation tool not only boasts industry leading AI accuracy reducing time spent on security reviews by 80%, but now also autofills in OneTrust portal questionnaires with a single click. Trying a proof...

NSO code verdict, Change Healthcare fallout, law firm breach

NSO Group to ordered to give Pegasus code to WhatsApp Change Healthcare confirms BlackCat, Schumer asks for aid Law firm announces data breach affecting 325,000 people Thanks to today's episode sponsor, Conveyor We've got a returning sponsor this week Conveyor. They're the AI security review automation platform helping infosec teams automate everything from securely sharing a SOC 2 to one-click autofilling security questionnaires in OneTrust so you can spend almost zero time on the manual tasks that make you want to throw your computer out the window. Teams are finding in a free proof of concept that their AI is...

Week in Review: GenAI BEC explodes, NIST updates framework, vending machine gaffe

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestRuss Ayres, SVP of Cyber & Deputy CISO,Equifax Thanks to our show sponsor, Egress People are the biggest risk to your organization's security, and they are most vulnerable when using email. With more advanced threats getting through secure email gateway detection every day, Egress provides AI-powered email security that eliminates both inbound phishing attacks and outbound data breaches. What's more, Egress' adaptive security architecture personalizes security for each user based on their real-time risk score. Visit egress.com to learn more about Egress' Intelligent Cloud Email Security...

Cencora pharma breach, Gen-AI explodes BEC, Chinese doorbell warning

Pharma giant Cencora announces data breach GenAI drives surge in BEC attacks Popular video doorbell easy hijacked Thanks to today's episode sponsor, Egress People are the biggest risk to your organizations' security and they are most vulnerable when using email. With more advanced threats getting through secure email gateway detection every day, Egress provides AI-powered email security that eliminates both inbound phishing attacks and outbound data breaches. What's more, Egress' adaptive security architecture personalizes security for each user based on their real-time risk score. Visit egress.com to learn more about Egress' Intelligent Cloud Email Security suite and start detecting email...

EO limits PII, Australia's espionage struggle, Lazarus zero-day

Biden signs order limiting the sale of personal data Australia claims its seeing unprecedented "foreign interference" Lazarus Group targeting Windows and PyPi Thanks to today's episode sponsor, Egress People are the biggest risk to your organizations' security and they are most vulnerable when using email. With more advanced threats getting through secure email gateway detection every day, Egress provides AI-powered email security that eliminates both inbound phishing attacks and outbound data breaches. What's more, Egress' adaptive security architecture personalizes security for each user based on their real-time risk score. Visit egress.com to learn more about Egress' Intelligent Cloud Email Security...

NIST framework 2.0, Optum linked to BlackCat, ScreenConnect exploitations continue

NIST releases cybersecurity framework 2.0 Optum attack linked to BlackCat ransomware ScreenConnect exploitations continue Thanks to today's episode sponsor, Egress People are the biggest risk to your organizations' security and they are most vulnerable when using email. With more advanced threats getting through secure email gateway detection every day, Egress provides AI-powered email security that eliminates both inbound phishing attacks and outbound data breaches. What's more, Egress' adaptive security architecture personalizes security for each user based on their real-time risk score. Visit egress.com to learn more about Egress' Intelligent Cloud Email Security suite and start detecting email threats your secure...

Cyber Security Headlines: SVR tactics, brand spamming, steel giant cyberattack

SolarWinds attackers changing tactics Brand domains used in spam operation Steel giant hit with cyberattack Thanks to today's episode sponsor, Egress People are the biggest risk to your organizations' security and they are most vulnerable when using email. With more advanced threats getting through secure email gateway detection every day, Egress provides AI-powered email security that eliminates both inbound phishing attacks and outbound data breaches. What's more, Egress' adaptive security architecture personalizes security for each user based on their real-time risk score. Visit egress.com to learn more about Egress' Intelligent Cloud Email Security suite and start detecting email threats your...

Police taunt LockBit, PayPal's cookie patent, vending machine controversy

British police taunt LockBit administrator PayPal files patent for new stolen cookies detector Vending machine crash reveals face recognition tech Thanks to today's episode sponsor, Egress People are the biggest risk to your organizations' security and they are most vulnerable when using email. With more advanced threats getting through secure email gateway detection every day, Egress provides AI-powered email security that eliminates both inbound phishing attacks and outbound data breaches. What's more, Egress' adaptive security architecture personalizes security for each user based on their real-time risk score. Visit egress.com to learn more about Egress' Intelligent Cloud Email Security suite and...

Week in Review: LockBit gets bitten, airline bot gaffe, exploding car keys

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestThom Langford, CISO,Velonetic Thanks to our show sponsor, Conveyor Conveyor AI is so good, it can now autofill OneTrust portal questionnaires in one click. Yes, we've been talking about it all week. Conveyor's security questionnaire automation tool not only boasts industry leading AI accuracy, but now fills in One Trust portals with a single click. Trying a proof of concept with your own data is always free. Learn more at www.conveyor.com. Mention this podcast for 5 free questionnaire credits when you purchase an Enterprise plan. All...

LockBit's thwarted upgrade, AT&T's massive outage, Change Healthcare cyberattack

LockBit was building next gen encryptor before takedown Thousands of wireless customers suffer outage Prescription delays due to Change Healthcare cyberattack Thanks to today's episode sponsor, Conveyor Conveyor, the security questionnaire automation software one of their customers dubbed "my favorite security tool of the year", is now even better.They've upgraded our browser extension for portal-based questionnaires and it can now autofill OneTrust portal questionnaires in one click.You can test the AI in a free proof of concept at www.conveyor.com. Mention this podcast for 5 free questionnaire credits when you purchase an Enterprise plan. Get the stories behind the headlines at...

LockBit gang doesn't keep its word, the LockBit bounty, White House tackles U.S. maritime threats

Thanks to today's episode sponsor, Conveyor Happy Thursday. Are you tired of us talking about how Conveyor's AI can now autofill OneTrust security questionnaires in one-click? Well, we'll stop talking about it if you come talk to them. Ready to give the market leading AI for security questionnaires a spin? Try a free proof of concept by booking a demo at www.conveyor.com. And mention this podcast for 5 free questionnaire credits when you purchase an Enterprise plan. Get the stories behind the headlines at CISOSeries.com

LockBit update, Signal usernames, NSA Cyber Director retires

LockBit takedown update Signal now lets users keep phone numbers private NSA Cybersecurity Director Rob Joyce to retire Thanks to today's episode sponsor, Conveyor No more portal scaries.Conveyor just launched AI autofill of OneTrust portal questionnaires. That means no more clicking question-by-question to copy-paste each answer when a customer sends you a OneTrust security questionnaire. Conveyor's AI will read and autofill the whole page for you. Trying a proof of concept with your own data is always free. Learn more at www.conveyor.com. Mention this podcast for 5 free questionnaire credits when you purchase an Enterprise plan. Get the stories behind...

LockBit disrupted, Cactus leaks Schneider data, ALPHV claims financial attacks

LockBit disrupted by global police operation Cactus leaks Schneider Electric data on dark web ALPHV gang takes credit for LoanDepot, Prudential attacks Thanks to today's episode sponsor, Conveyor Conveyor, the security questionnaire automation software one of our customers dubbed "my favorite security tool of the year", is now even better.They've upgraded their browser extension for portal-based questionnaires and it can now autofill OneTrust portal questionnaires in one click.You can test the AI in a free proof of concept at www.conveyor.com. Mention this podcast for 5 free questionnaire credits when you purchase an Enterprise plan. Get the stories behind the headlines...

Chrome protects home, Zeus mastermind guilty, airline chatbot gaffe

Google Chrome feature blocks attacks against home networks Mastermind behind Zeus and IcedID malware pleads guilty Air Canada must honor refund invented by its chatbot, says court Thanks to today's episode sponsor, Conveyor Conveyor AI is so good, it can now autofill OneTrust portal questionnaires in one click. Yes, you heard us right. Conveyor's security questionnaire automation tool not only boasts industry leading AI accuracy, but now fills in One Trust portals with a single click. Trying a proof of concept with your own data is always free. Learn more at www.conveyor.com. Mention this podcast for 5 free questionnaire credits...

Week in Review: LLMs improve cyberattacks, Rhysida gets decrypted, US Blackcat bounty

Link to blog post This week's Cyber Security Headlines - Week in Review is hosted by Rich Stroffolino with guest Trina Ford, CISO, iHeartMedia Thanks to our show sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go...

Microsoft zero-day warning, Neuberger addresses Munich, trojan steals faces

Microsoft warns of new Exchange Server zero-day Neuberger: Pace of ransomware takedown operations isn't enough Gold Pickaxe malware steals your face Huge thanks to our sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and...

Trans-Northern breach, malicious LLM usage, massive email leak

Trans-Northern Pipelines confirms cyberattack Threat actors using LLMs to improve cyberattacks Email provider published internal emails in plain text Huge thanks to our sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and watch their...

Prudential data breached, Facebook Marketplace leak, BoA 3rd party breach

Prudential Financial data breached in cyberattack Facebook Marketplace user records leaked on hacking forum Bank of America customers at risk after third party breach Huge thanks to our sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go...

Repository framework, Romanian healthcare attack, Ivanti backdoored

CISA releases repository security framework Ransomware takes down Romanian healthcare management system Ivanti flaw used to deploy backdoor Huge thanks to our sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and watch their 3-minute...

Raspberry Robin warning, Hyundai ransomware attack, Cisco job cuts

Raspberry Robin a new one-day exploit targeting Windows Hyundai Europe suffers Black Basta ransomware attack Cisco to cut thousands of jobs as it focuses on high growth areas Huge thanks to our sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk....

Week in Review: Volt Typhoon warning, Cloudflare's nation-state breach, $25 million deepfake

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestDoug Mayer, vp, CISO,WCG Thanks to our show sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and watch their 3-minute...

Volt Typhoon warning, Cisco fixes Expressway, credit union theft

CISA, FBI issue sobering warning about Volt Typhoon Cisco fixes critical Expressway flaws 3 million records from thousands of credit unions exposed Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso...

CISA collaboration challenges, Iran's cyber efforts, ransomware's $1 billion

CISA collaboration initiative on thin ice Iran focusing cyber efforts Ransomware payments cross $1 billion in 2023 Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and watch their 3-minute product...

United front against spyware, spyware to blame for most Google zero-days, insider data breach hits Verizon

Tech giants and world govs unite to tackle spyware threats Spyware vendors to blame for most Google zero-days Insider data breach hits almost half of Verizon's employee base Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vantais the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner withVantato automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more,...

Spoutible API Leak, Fake IDs at scale, Sudo Windows

Spoutible API vulnerability leaks user data Illicit service cranks out fake IDs Sudo coming to Windows Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and watch their 3-minute product demo....

Cloudflare announces breach, AnyDesk announces breach, Children's hospital attacked

Cloudflare announces nation-state level breach AnyDesk says hackers breached production servers, reset passwords Chicago children's hospital announces cyberattack Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and watch their 3-minute...

Week in Review: Microsoft email explanation, Brazilian banking trojan, Mercedes GitHub error

Link to blog post Cyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestMary Rose Martinez, vp, CISOMarathon Petroleum Thanks to our show sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and watch their...

FBI Director's warning, Apple flaw warning, Pentagon supplier breach

FBI director warns of Chinese hacker threat to U.S. critical infrastructure CISA warns of exploited Apple flaw Pentagon Intelligence supplier allegedly hacked Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso...

Volt Typhoon takedown, refusing ransoms, Binance's big leak

FBI grounds Volt Typhoon More companies refuse to pay ransoms Binance internal info exposed on GitHub Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and watch their 3-minute product demo....

Mercedes-Benz leak, Juniper Networks patch, ZLoader is back

Mercedes-Benz exposes sensitive data, source code Juniper Networks issues out-of-band fix for high severity flaws New ZLoader malware, now with 64-bit Windows compatibility Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to...

Microsoft takes another hit, Energy giant hit by ransomware, the NSA is secretly buying your data

Microsoft takes another hit Energy giant hit by ransomware The NSA is secretly buying your data Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso and watch their 3-minute product demo....

Jenkins patch alert, Cisco flaw alert, Russia's intel wiped

Urgent patch alert for Jenkins Cisco flaw exposes Unified Comms systems Pro-Ukraine hackers wipe 2 petabytes of data from Russian intelligence center Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To learn more, go to vanta.com/ciso...

Week in Review: TeamViewer still abused, ransomware's hidden costs, X supports passkeys

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guest Mike Kelley, vp, CISO,The E.W. Scripps Company and partner, OTAWireless.com. Thanks to our show sponsor, Conveyor Conveyor, the security questionnaire automation software known for generating the most accurate AI answers to questionnaires is launching a much-requested feature. Conveyor's AI can now use uploaded security documents like a SOC 2 and security policy whitepapers to auto-generate precise answers to entire questionnaires in seconds. See why customers like Lucid and Carta are raving about the software and try the AI yourself in a free proof of concept...

Hewlett Packard breach, exposed API study, Ukraine infrastructure attacks

Hewlett Packard Enterprise (HPE) attacked through Microsoft 365 email system Study reveals 18,000 exposed API secrets, including $20 million in vulnerable Stripe tokens Ukrainian energy, postal, and transportation services hit by cyberattacks Thanks to today's episode sponsor, Conveyor Conveyor, the security questionnaire automation software known for generating the most accurate AI answers to questionnaires is launching a much-requested feature. Conveyor's AI can now use uploaded security documents like a SOC 2 and security policy whitepapers to auto-generate precise answers to entire questionnaires in seconds. See why customers like Lucid and Carta are raving about the software and try the AI...

EquiLend offline, AI fueling ransomware, "mother of all breaches"

Cyberattack knocks EquiLend offline Brits warn of the AI impact on ransomware Data leak claims to hold over 26 billion records Thanks to today's episode sponsor, Conveyor Conveyor, the security questionnaire automation software one of our customers dubbed "my favorite security tool of the year", is now even better. How? Conveyor's AI can now use uploaded security documents like a SOC 2 or security policy document to auto-generate precise answers to entire security questionnaires in seconds. You can test the AI in a free proof of concept at www.conveyor.com.

CISA boss swatted, Subway investigates LockBit, Australia sanctions hacker

CISA boss targeted in "harrowing" swatting attack Subway puts a LockBit investigation on the menu Australia sanctions REvil hacker behind Medibank data breach Thanks to today's episode sponsor, Conveyor Ever wish AI could auto-generate answers to security questionnaires for you just based on your SOC 2 or other documents? Spoiler alert - it can and you can now try it for free with Conveyor's AI security questionnaire automation software. Set up takes a few seconds. Get a free Conveyor account and simply upload your security documents. Then, upload a new questionnaire to see AI generate answers in seconds based on...

Thailand's data leak, CISA's Ivanti order, security funding drips

Thailand court attempts to suppress data leak CISA issues emergency directive on Ivanti zero-days Cybersecurity startup funding down 50% Huge thanks to our episode sponsor, Conveyor What's worse than a last minute security questionnaire in your inbox? Having to maintain a thousand question and answer pairs to use to respond to a questionnaire. Now, Conveyor's AI security questionnaire automation software can use security documents like a SOC 2 and a pared down question and answer bank to auto-generate precise answers to entire questionnaires in seconds. Try a free proof of concept today at www.conveyor.com.

Russia Microsoft breach, JPMorganChase hacking increase, TeamViewer still abused

Russian hackers breach Microsoft executive emails to learn about themselves JPMorgan Chase says hacking attempts are increasing TeamViewer still being abused to breach networks in new ransomware attacks Thanks to today's episode sponsor, Conveyor AI can now literally answer any question in seconds, yet infosec teams are still in a living nightmare manually filling out questionnaires. Conveyor AI's can now use your uploaded security documents to auto-generate precise answers to entire questionnaires. The software one of our customers dubbed "my favorite security tool of the year" in 2023 has gotten even better and it takes just minutes to get started....

Week in Review: SEC X breach, pwned highlights leak, Kyivstar attack cost

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestJerich Beason, CISO,WM Thanks to our show sponsor, Savvy Security Shadow identities on SaaS apps are growing unchecked, rapidly expanding an attack surface where businesses have little-to-no visibility or control. Savvy helps security teams safely embrace SaaS benefits by automating the discovery and removal of the most toxic combinations of SaaS identity risk. Savvy's automation playbooks and just-in-time security guardrails guide users at scale towards proper identity hygiene. That's SavvyIdentity-First SaaS Security. Learn more at savvy.security/headlines. All links and the video of this episode can be...

Atlassian Jira outage, iPhone spyware solution, Russia's Europe espionage

Atlassian outage briefly affected multiple cloud services iShutdown helps discover spyware on iPhones Russian state hackers COLDRIVER deploy malware in European espionage campaign Huge thanks to our sponsor, Savvy Security Shadow identities on SaaS apps are growing unchecked, rapidly expanding an attack surface where businesses have little-to-no visibility or control. Savvy helps security teams safely embrace SaaS benefits by automating the discovery and removal of the most toxic combinations of SaaS identity risk. Savvy's automation playbooks and just-in-time security guardrails guide users at scale towards proper identity hygiene. That's SavvyIdentity-First SaaS Security. Learn more at savvy.security/headlines. For the stories behind...

Drone threats, PixieFail firmware, HIBP dataset

Chinese drones considered national security threat PixieFail could spell trouble for cloud providers Have I Been Pwned adds "statistically significant" data leak Huge thanks to our sponsor, Savvy Security Shadow identities on SaaS apps are growing unchecked, rapidly expanding an attack surface where businesses have little-to-no visibility or control. Savvy helps security teams safely embrace SaaS benefits by automating the discovery and removal of the most toxic combinations of SaaS identity risk. Savvy's automation playbooks and just-in-time security guardrails guide users at scale towards proper identity hygiene. That's SavvyIdentity-First SaaS Security. Learn more at savvy.security/headlines.

Google patches zero-day, Citrix zero-day warning, Phemedrone stealer warning

Google patches first Chrome zero-day vulnerability of the year Urgent warning from Citrix to patch two zero-day vulnerabilities New malware strain persists despite patch Huge thanks to our sponsor, Savvy Security Shadow identities on SaaS apps are growing unchecked, rapidly expanding an attack surface where businesses have little-to-no visibility or control. Savvy helps security teams safely embrace SaaS benefits by automating the discovery and removal of the most toxic combinations of SaaS identity risk. Savvy's automation playbooks and just-in-time security guardrails guide users at scale towards proper identity hygiene. That's SavvyIdentity-First SaaS Security. Learn more at savvy.security/headlines.

VPN blocks, OpenAI election tools, Calvia ransomware attack

Turkey blocks some VPNs OpenAI publishes election guidance Spanish municipality faces stiff ransomware demand Huge thanks to our sponsor, Savvy Security Shadow identities on SaaS apps are growing unchecked, rapidly expanding an attack surface where businesses have little-to-no visibility or control. Savvy helps security teams safely embrace SaaS benefits by automating the discovery and removal of the most toxic combinations of SaaS identity risk. Savvy's automation playbooks and just-in-time security guardrails guide users at scale towards proper identity hygiene. That's SavvyIdentity-First SaaS Security. Learn more at savvy.security/headlines.

Water nonprofit targeted, Denmark energy update, SEC X update

Ransomware gang targets clean water nonprofit Denmark energy sector attacks likely not Sandworm after all SEC says X account breach did not lead to further breaches Thanks to our episode sponsor, Savvy Security Shadow identities on SaaS apps are growing unchecked, rapidly expanding an attack surface where businesses have little-to-no visibility or control. Savvy helps security teams safely embrace SaaS benefits by automating the discovery and removal of the most toxic combinations of SaaS identity risk. Savvy's automation playbooks and just-in-time security guardrails guide users at scale towards proper identity hygiene. That's SavvyIdentity-First SaaS Security. Learn more at savvy.security/headlines. For...

Week in Review: Merck settles NotPetya, Google accounts hacked, GitHub abuse rises

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestAllan Cockriel, Group CISO,Shell Thanks to our show sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To see Vanta's platform firsthand and access resources plus a...

Ivanti zero-day, Akira targets backups, school data exposed

Ivanti VPN hit by zero-days Akira targeting backups Sensitive school data accidentally exposed online Remember to subscribe to the Cyber Security Headlines newsletter here. Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To see Vanta's platform...

Texas healthcare breach, enormous Brazil leak, Tortilla decryptor released

Texas healthcare provider suffer data breach Entire population of Brazil possibly exposed in data leak Decryptor for Tortilla ransomware released Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To see Vanta's platform firsthand and access resources...

SEC account hack spikes Bitcoin, Mandiant Twitter hijack, China cracks AirDrop

Bitcoin price spikes after SEC Twitter account hijack Twitter account hijack wave affects Mandiant China claims it cracked Apple AirDrop Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To see Vanta's platform firsthand and access resources...

google hacked, loanDepot attacked, Netgear compromised

Google accounts hacked: No passwords required loanDepot joins growing list of US mortgage lenders attacked Netgear and Hyundai's X accounts latest to be compromised in crypto scam Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To...

Merck settles NotPetya, Pompompurin breaches release, Iranian crypto mistake

Merck and its insurers settle $1.4 billion NotPetya case BreachForums admin Popompurin breaches terms of pretrial freedom Iranian crypto exchange Bit24.cash accidentally exposes customer data Thanks to today's episode sponsor, Vanta From dozens of spreadsheets and screenshots to fragmented tools and manual security reviews, managing the requirements for modern compliance and security programs is increasingly challenging. Vanta is the leading Trust Management Platform that helps you centralize your efforts to establish trust and enable growth across your organization. Over 6,000 companies partner with Vanta to automate compliance, strengthen security posture, streamline security reviews, and reduce third-party risk. To see Vanta's...

Week in Review: Hospitals sue cloud, Google settles Incognito, ransomware payment ban

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestJohna Till Johnson, CEO,Nemertes, and podcaster atHeavy Strategy. Thanks to our show sponsor, NetSPI Take the hassle out of dealing with alert fatigue, validation, and prioritization. Instead, use NetSPI's ASM platform to hone in on what's actually important. Attack surface vulnerabilities constantly evolve, causing a lack of visibility and overwhelm for your security teams. Start the new year off right by partnering with NetSPI to enhance your security program. Visitnetspi.com/ASM All links and the video of this episode can be found on CISO Series.com

Mandiant Twitter hack, breach firm breached, Spanish mobile attacked

Mandiant Twitter account restored after crypto scam hack Law firm that handles data breaches hit by data breach Spanish mobile carrier suffers outage after account takeover Thanks to today's episode sponsor, NetSPI Take the hassle out of dealing with alert fatigue, validation, and prioritization. Instead, use NetSPI's ASM platform to hone in on what's actually important. Attack surface vulnerabilities constantly evolve, causing a lack of visibility and overwhelm for your security teams. Start the new year off right by partnering with NetSPI to enhance your security program. Visit netspi.com/ASM to learn more. For the stories behind the headlines, head to...

Ransomware bans, voice cloning contest, slow data exports

A call for formal ban on ransomware payments FTC asks for ideas to fight voice cloning Cyberattack impacts French township Thanks to today's episode sponsor, NetSPI Take the hassle out of dealing with alert fatigue, validation, and prioritization. Instead, use NetSPI's ASM platform to hone in on what's actually important. Attack surface vulnerabilities constantly evolve, causing a lack of visibility and overwhelm for your security teams. Start the new year off right by partnering with NetSPI to enhance your security program. Visit netspi.com/ASM to learn more.

Google $5 billion suit settled, Orbit Chain loses $80M, FDA cyber agreement

Google settles $5 billion 'incognito mode' lawsuit Over $80 million in crypto stolen from Orbit Chain Watchdog calls for updated medical device cyber agreement Thanks to today's episode sponsor, NetSPI Take the hassle out of dealing with alert fatigue, validation, and prioritization. Instead, use NetSPI's ASM platform to hone in on what's actually important. Attack surface vulnerabilities constantly evolve, causing a lack of visibility and overwhelm for your security teams. Start the new year off right by partnering with NetSPI to enhance your security program. Visit netspi.com/ASM to learn more. Take the hassle out of dealing with alert fatigue, validation,...

Sweden grocer cyberattack, Black Basta flaw, Boston hospital cyberattack

Swedish national grocer stung by Cactus Flaw in Black Basta decryptor allows recovery of victims' files - temporarily Cyberattack hist Boston area hospital Thanks to today's episode sponsor, NetSPI Take the hassle out of dealing with alert fatigue, validation, and prioritization. Instead, use NetSPI's ASM platform to hone in on what's actually important. Attack surface vulnerabilities constantly evolve, causing a lack of visibility and overwhelm for your security teams. Start the new year off right by partnering with NetSPI to enhance your security program. Visit netspi.com/ASM to learn more. For the stories behind the headlines, head to CISOseries.com.

German hospital ransomware, Ohio Lottery attacked, First American update

LockBit hits German hospital system over the holidays Ohio Lottery cyberattack claimed by DragonForce First American says funds are secure Thanks to today's episode sponsor, Barricade Cyber Solutions Don't let ransomware ruin the holidays again this year! Prepare and spread holiday cheer with recoverfromransomware.com! The trusted DFIR experts at Barricade Cyber Solutions have saved 3,000 and counting businesses from ransomware attacks, including small and medium businesses just like yours! Barricade Cyber is YOUR solution for rapid data and systems recovery. Book a meeting directly with the CEO to discover how to recover from ransomware. Visit recoverfromransomware.com. For the stories behind...

Barracuda backdoors, undocumented iPhone hardware, NYT sues OpenAI

Threat actors install backdoor on Barracuda appliances iPhone triangulation exploit used undocumented features New York Times starts the publisher LLM lawsuits Thanks to today's episode sponsor, Barricade Cyber Solutions Don't let ransomware ruin the holidays again this year! Prepare and spread holiday cheer with recoverfromransomware.com! The trusted DFIR experts at Barricade Cyber Solutions have saved 3,000 and counting businesses from ransomware attacks, including small and medium businesses just like yours! Barricade Cyber is YOUR solution for rapid data and systems recovery. Book a meeting directly with the CEO to discover how to recover from ransomware. Visit recoverfromransomware.com.

National Amusements breached, Rockstar game leak, LoanCare parent hacked

CBS and Paramount owner hacked a year ago Rockstar Games allegedly suffers source code leak LoanCare says 1.3 million people affected by cyberattack Thanks to today's episode sponsor, Barricade Cyber Solutions When you're hit with ransomware, remember recoverfromransomware.com. Barricade Cyber Solutions' experienced DFIR team is ready to help your business recover from ransomware now. You'll work directly with the CEO to resolve your case quickly and efficiently. Whether you're experiencing a ransomware attack or want to get ahead of one by discussing a prevention plan, contact Barricade Cyber Solutions at recoverfromransomware.com. For the stories behind the headlines, visit CISOseries.com.

First American cyberattack, Iran APT campaign, ransomware victims spike

First American suffers cyberattack, website down Iran-linked group targets defense contractors worldwide November saw record numbers of ransomware leak site victims Thanks to today's episode sponsor, Barricade Cyber Solutions Encountering a ransomware attack? Keep cool and reach out to Barricade Cyber Solutions, the trusted DFIR experts. Barricade is known for helping small and medium businesses just like yours restore their business data and successfully recover from ransomware. Escape the ransomware nightmare and bring your business back online now. Contact Barricade Cyber Solutions today at recoverfromransomware.com. That's recoverfromransomware.com. For the stories behind the headlines, head to CISOseries.com.

HCL investigates ransomware, Agent Tesla returns, JavaScript bank malware

Indian tech company HCL investigating ransomware attack Agent Tesla and an old Microsoft Office vulnerability create new problems New JavaScript malware targets banks Thanks to today's episode sponsor, Barricade Cyber Solutions Is ransomware affecting your business operations? Contact Barricade Cyber Solutions at recoverfromransomware.com. Barricade Cyber Solutions are elite DFIR experts who come to the rescue for businesses like yours daily. The trusted team at Barricade Cyber traces the source of infiltration and fortifies your defenses. Depend on Barricade Cyber Solutions for your data and system security prevention and recovery. Go to recoverfromransomware.com and set up a time to connect with...

BlackCat is back, CSAM in AI data, ESO breach

BlackCat came back Child abuse images found in AI datasets ESO solutions breach impacts million Thanks to today's episode sponsor, Barricade Cyber Solutions Has your organization fallen victim to ransomware? Remain calm and head over to recoverfromransomware.com. Barricade Cyber Solutions is the "go-to" for ransomware recovery services that small to medium business executives can trust. Over the past 5 years, Barricade Cyber Solutions has saved 3,000+ businesses in your shoes. Trust the elite DFIR team at Barricade Cyber Solutions with your data and system security recovery. Book a free consultation with the CEO at recoverfromransomware.com now.

FBI disrupts BlackCat, International operation nabs thousands, Sony data leak

FBI disrupts BlackCat ransomware network International operation arrests thousands of cybercriminals Sony's video game plans leaked by ransomware group Thanks to today's episode sponsor, Barricade Cyber Solutions Don't let ransomware ruin your holiday. Remember to visit recoverfromransomware.com! Barricade Cyber Solutions are THE trusted DFIR experts, and they've saved 3,000 and counting businesses from ransomware attacks, small and medium businesses just like yours! Barricade Cyber is YOUR solution for rapid data and security systems recovery. Book a meeting directly with the CEO to discuss securing your future today. Head over to recoverfromransomware.com to learn more. For the stories behind the headlines,...

Play ransomware warning, QakBot is back, Mr. Cooper hack

Play ransomware is no game The return of QakBot Hacking with Mr. Cooper Huge thanks to our sponsor, Barricade Cyber Solutions Facing a ransomware attack? Don't panic, remain calm and remember to contact Barricade Cyber Solutions, the DFIR team trusted to quickly recover business data with exclusive ransomware recovery services for small and medium businesses alike. Recover from ransomware and get your business back online with Barricade Cyber Solutions. Visit recoverfromransomware.com to schedule a call with the team today.

Box suffers outage, MongoDB suffers breach, States lag in tackling political deepfakes

Box storage platform suffers outage MongoDB suffers breach States lag in tackling political deepfakes Thanks to today's episode sponsor, Barricade Cyber Solutions Experiencing ransomware? Barricade Cyber Solutions will help you recover from the nightmare. Trust the industry DFIR experts who have rescued over 3,000 businesses cases over the past 5 years. Remember to visit recoverfromransomware.com and connect with Barricade Cyber Solutions rapid ransomware recovery team. This elite team works quickly to recover and restore your business data and services. All you need to remember is recoverfromransomware.com. For the stories behind the headlines, head to CISOseries.com.

Week in Review: Irish water hack, Joe Sullivan speaks, UK ransomware predictions

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestRusty Waldron, Chief Business Security Officer,ADP Thanks to our show sponsor, Barricade Cyber Solutions Are ransomware attackers causing your business MAJOR disruptions? Connect with Barricade Cyber Solutions, the trusted DFIR experts specializing in helping small to medium businesses, like yours, recover from ransomware. Barricade Cyber Solutions has a proven track record of successfully handling over 3,000 business cases and counting with advanced recovery services to quickly restore business data and services. Recover from ransomware with Barricade Cyber Solutions at recoverfromransomware.com. All links and the video of...

Hive banker arrested, train bricking accusations, GambleForce SQL campaign

French police arrest alleged Hive banker Train bricking accusations lead to lawsuit against ethical hackers New Hacker Group 'GambleForce' Targets APAC through SQL injection Thanks to today's episode sponsor, Barricade Cyber Solutions Has your organization faced a ransomware attack? Keep calm, breathe, and head over to recoverfromransomware.com. Barricade Cyber Solutions is the industry choice for ransomware recovery services that small and medium business leaders can rely on. With a track record of rescuing over 3,000+ businesses like yours in the last 5 years alone, you can trust Barricade Cyber Solutions' elite DFIR team for the recovery of your business' data...

UK ransomware report, OAuth abuse, push notification changes

UK ransomware report isn't pretty MS warns of OAuth abuse Apple discloses pushback to push notification disclosure Thanks to today's episode sponsor, Barricade Cyber Solutions Don't let ransomware ruin the holidays again this year! Prepare and spread holiday cheer with recoverfromransomware.com! The trusted DFIR experts at Barricade Cyber Solutions have saved 3,000 and counting businesses from ransomware attacks, including small and medium businesses just like yours! Barricade Cyber is YOUR solution for rapid data and systems recovery. Book a meeting directly with the CEO to discover how to recover from ransomware. Visit recoverfromransomware.com.

Ukraine telco down, Sullivan advocates for CISOs, GAO on AI

Cyberattack shuts down Ukrainian telco Former Uber CISO advocates for CISO protections GAO report on government AI usage Thanks to today's episode sponsor, Barricade Cyber Solutions When you're hit with ransomware, remember recoverfromransomware.com. Barricade Cyber Solutions' experienced DFIR team is ready to help your business recover from ransomware now. You'll work directly with the CEO to resolve your case quickly and efficiently. Whether you're experiencing a ransomware attack or want to get ahead of one by discussing a prevention plan, contact Barricade Cyber Solutions at recoverfromransomware.com.

Internet fragmentation, EU AI Act, Lazarus loves Log4Shell

US tries to avoid internet fragmentation EU reaches agreement on AI Act North Korea finds continued success with Log4Shell Thanks to today's episode sponsor, Barricade Cyber Solutions Encountering a ransomware attack? Keep cool and reach out to Barricade Cyber Solutions, the trusted DFIR experts. Barricade is known for helping small and medium businesses just like yours restore their business data and successfully recover from ransomware. Escape the ransomware nightmare and bring your business back online now. Contact Barricade Cyber Solutions today at recoverfromransomware.com. That's recoverfromransomware.com.

5G network vulnerability, SLAM affects CPUs, CISA Qlik warning

5G network security vulnerabilities discovered, impacting chipset vendors and smartphones SLAM Spectre-based vulnerability affects CPUs CISA adds Qlik bugs to exploited vulnerabilities catalog Thanks to today's episode sponsor, Barricade Cyber Solutions Caught in a ransomware crisis? Barricade Cyber Solutions is your lifeline for recovery. Trust the industry's experienced DFIR experts, with a track record of saving over 3,000 businesses in the last 5 years. Remember to visit recoverfromransomware.com to connect with Barricade Cyber Solutions' trusted ransomware recovery team. This elite squad moves quickly to restore your business data and services. Visit recoverfromransomware.com today. For the stories behind the headlines, head...

Week in Review: Credit Union outages, Roblox, Twitch targeted, Nuclear site breached

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestAndy Ellis, operating partnerYL Ventures Thanks to our show sponsor, Barricade Cyber Solutions Are ransomware attackers causing disruptions? Remember to stay composed and immediately contact Barricade Cyber Solutions, the trusted ransomware recovery experts specializing in small to medium businesses. Barricade Cyber Solutions has a proven track record of successfully handling over 3,000 business cases and counting- with advanced recovery services for rapid business restoration. Recover from ransomware with Barricade Cyber Solutions. Visit recoverfromransomware.com to learn more. All links and the video of this episode can be...

Aviva cyberattack warning, anti-aircraft data theft, car fleet vulnerability

Insurance firm sees cyberattacks as more likely than fire or theft North Korean hackers steal anti-aircraft system data Vulnerability discovered in fleet management software Huge thanks to our sponsor, Barricade Cyber Solutions Is ransomware affecting your business? Contact Barricade Cyber Solutions at recoverfromransomware.com. Barricade Cyber Solutions are elite DFIR experts who come to the rescue for businesses like yours daily. The trusted team at Barricade Cyber traces the source of infiltration and fortifies your defenses. Depend on Barricade Cyber Solutions for your data and system security. Remember recoverfromransomware.com, that's recoverfromransomware.com. For the stories behind the headlines, head to CISOseries.com.

ICANN lookups, push notification spying, Google's Gemini

Krebs on ICANN Lookups Wyden warns of spying push notifications Google unveils Gemini Huge thanks to our sponsor, Barricade Cyber Solutions Has your organization fallen victim to ransomware? Remain calm and head over to recoverfromransomware.com. Barricade Cyber Solutions is the "go-to" for ransomware recovery services that small to medium business executives can trust. Over the past 5 years, Barricade Cyber Solutions has saved 3,000+ businesses in your shoes. Trust the elite DFIR team at Barricade Cyber Solutions with your data and system security recovery. Book a free consultation at recoverfromransomware.com now.

Mexican spyware trial, Breach of ColdFusion vuln, Malicious loan app downloaded 12MM

Spyware trial implicating former Mexican president kicks off Federal agency breached through Adobe ColdFusion vulnerability Malicious loan app downloaded 12 million times from Google Play Huge thanks to our sponsor, Barricade Cyber Solutions Don't let ransomware ruin your holiday. Remember to visit recoverfromransomware.com! Barricade Cyber Solutions are THE trusted DFIR experts, and they've saved 3,000 and counting businesses from ransomware attacks, small and medium businesses just like yours! Barricade Cyber is YOUR solution for rapid data and security systems recovery. Book a meeting directly with the CEO to discuss securing your future today. Visit recoverfromransomware.com. That's recoverfromransomware.com. For the stories...

Nuclear site hacked, Iranian water breaches, ChatGPT data leaks

UK nuclear site attacked by state-linked attackers US confirms Iranian actors behind water breaches The infinite regress of ChatGPT data exfiltration Huge thanks to our sponsor, Barricade Cyber Solutions Facing a ransomware attack? Don't panic, remain calm and remember to contact Barricade Cyber Solutions, the DFIR team trusted to quickly recover business data with exclusive ransomware recovery services for small and medium businesses alike. Recover from ransomware and get your business back online with Barricade Cyber Solutions. Visit recoverfromransomware.com to schedule a call with the team today. That's recoverfromransomware.com.

Credit Unions outage, Roblox-Twitch extortion, Apple zero-days

Credit unions facing outages due to ransomware attack on cloud provider Roblox, Twitch allegedly targeted by ransomware cartel Apple fixes two new iOS zero-days in emergency updates Huge thanks to our sponsor, Barricade Cyber Solutions Experiencing ransomware? Barricade Cyber Solutions will help you recover from the nightmare. Trust the industry DFIR experts who have rescued over 3,000 business cases over the past 5 years. Remember to visit recoverfromransomware.com and connect with Barricade Cyber Solutions rapid ransomware recovery team. This elite team works quickly to recover and restore your business data and services. Visit recoverfromransomware.com today. For the stories behind the...

Week in Review: Okta breach expands, Former Uber CISO speaks, OpenAI's chatbot leak secrets

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestChristina Shannon, CIO,KIK Consumer Products Thanks to our show sponsor, SpyCloud SpyCloud disrupts cybercrime by telling you what criminals know about your business and your customers, so you can take action on exposed authentication data to prevent ransomware, session hijacking, account takeover, and online fraud. With knowledge of the specific data criminals have in hand like credentials, cookies, and PII compromised by breaches and malware infections security teams have better visibility into the expanding attack surface that puts their organization at risk of cyberattacks and can...

Manufacturing tops extortion, RETVec battles spam, new Zyxel warnings

Manufacturing industry tops cyber extortion trend Google's RETVec the latest warrior on bad emails Zyxel warns of vulnerabilities in NAS devices Huge thanks to our sponsor, SpyCloud New research from SpyCloud reveals a critical discovery: nearly a third of ransomware victim companies this year were infected with infostealer malware like Raccoon, Vidar or Redline before they were attacked. These infostealers exfiltrate authentication data from infected systems to aid follow-on attacks everything from passwords to 2FA codes, and even cookies that enable session hijacking without the need for credentials at all. SpyCloud specializes in recapturing and remediating data siphoned from infostealers...

Okta breach expands, JAXA cyberattack, leaky GPTs

All Okta customers exposed in breach JAXA hit by cyberattack OpenAI's chatbots leak secrets Huge thanks to our sponsor, SpyCloud For some people ignorance is bliss but that's not an option for those of us in cybersecurity. SpyCloud has a free tool that lets you check your company's darknet exposure, and you might find some things that are pretty alarming. Go to spycloud.com/ciso to see your company's exposure from data breaches and even infostealer malware infections that can open the door to ransomware. SpyCloud's focus is helping businesses act on what criminals are using right now to target them addressing...

Ransomware gang busted in Ukraine, North Texas water utility cyberattack, Former Uber CISO breaks 6-year silence

Ransomware gang busted in Ukraine by international operation North Texas water utility hit with cyberattack Former Uber CISO speaks out after 6-year silence Huge thanks to our sponsor, SpyCloud SpyCloud has discovered that infostealer malware infections are an early warning signal for ransomware. In fact, nearly a third of ransomware victim companies this year were infected with infostealer malware like Raccoon, Vidar or Redline before they were attacked. Are you thinking about infostealers as a precursor to ransomware? SpyCloud believes that knowing what criminals have stolen from your managed, unmanaged and undermanaged infected machines is step one to stopping ransomware...

International AI agreement, water utility attack, Ukraine cyberattack on Russian aviation

International AI agreement PA water utility hit by cyberattack Ukraine claims cyber attack against Russian aviation Huge thanks to our sponsor, SpyCloud Our sponsor today, SpyCloud, wants us to pay attention to a ransomware precursor that's not being talked about enough: infostealer malware. If you think you're covered by endpoint protection and anti-virus solutions, think again. The SpyCloud team discovered that the presence of infostealers including Racoon, Vidar, and Redline on machines accessing work applications may indicate a likely future ransomware attack. They believe the first step in thwarting ransomware lies in knowing the data criminals have stolen from malware-infected...

London & Zurich, Fidelity National Financial attacks, Royal Family's hospital, Vanderbilt University Med Center attacks, US Nuclear lab and Gulf Air breaches

London & Zurich, and Fidelity National Financial attacks Royal Family's hospital and Vanderbilt University Med Center suffer cybersecurity incidents Gulf Air exposed to data breach Huge thanks to our sponsor, SpyCloud For some people ignorance is bliss but that's not an option for those of us in cybersecurity. SpyCloud has a free tool that lets you check your company's darknet exposure, and you might find some things that are pretty alarming. Go to spycloud.com/ciso to see your company's exposure from data breaches and even infostealer malware infections that can open the door to ransomware. SpyCloud's focus is helping businesses act...

Cyber exec hacked hospital, 'Citrix Bleed' vuln targeted, Binance CEO steps down in $4 billion settlement

Cyber exec admits hacking hospital as a sales tactic 'Citrix Bleed' vulnerability targeted by nation-state hackers Binance CEO steps down in $4 billion settlement Thanks to today's episode sponsor, Egress People are the biggest risk to your organizations' security and they are most vulnerable when using email. Egress is the only cloud email security platform to use an adaptive security architecture to automate threat detection and response for advanced phishing attacks and outbound data breaches, tailoring the experience for each user based on their real-time risk score. Visit egress.com to learn more about Egress' Intelligent Cloud Email Security suite and...

Healthcare hit with MOVEit, malware uses trig, OpenAI shakeup

Healthcare platform impacted by MOVEit Threat actors find a use for trigonometry What's happening with OpenAI Thanks to today's episode sponsor, Egress People are the biggest risk to your organizations' security and they are most vulnerable when using email. Egress is the only cloud email security platform to use an adaptive security architecture to automate threat detection and response for advanced phishing attacks and outbound data breaches, tailoring the experience for each user based on their real-time risk score. Visit egress.com to learn more about Egress' Intelligent Cloud Email Security suite and start detecting email threats your existing solution is...

Clorox CISO departure, BlackCat's SEC complaint, Dudley interim NCD

Clorox CISO departs months after cyberattack ALPHV/BlackCat Ransomware gang files SEC complaint Drenan Dudley acting national cyber director while Coker confirmation process continues Thanks to today's episode sponsor, Egress People are the biggest risk to your organizations' security and they are most vulnerable when using email. Egress is the only cloud email security platform to use an adaptive security architecture to automate threat detection and response for advanced phishing attacks and outbound data breaches, tailoring the experience for each user based on their real-time risk score. Visit egress.com to learn more about Egress' Intelligent Cloud Email Security suite and start...

Week in Review: UK Health data shared, SSH keys vulnerable

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestJay Wilson, CISO,Insurity Thanks to our show sponsor, Sysdig For businesses innovating in the cloud, every second counts. Sysdig strengthens cyber resilience by reducing the attack surface, detecting threats in real time, and accelerating incident response. Our platform correlates signals across cloud workloads, identities, and services to enable businesses to prioritize risks and act decisively. Sysdig. Secure every second. Learn more at Sysdig.com All links and the video of this episode can be found on CISO Series.com

Fortinet Injection bug, Another Samsung breach, government Rhysida warning

Fortinet warns of critical command injection bug in FortiSIEM Another data breach for Samsung Rhysida warning from FBI and CISA Thanks to today's episode sponsor, Sysdig For businesses innovating in the cloud, every second counts. Sysdig strengthens cyber resilience by reducing the attack surface, detecting threats in real time, and accelerating incident response. Our platform correlates signals across cloud workloads, identities, and services to enable businesses to prioritize risks and act decisively. Sysdig. Secure every second. For the stories behind the headlines, head toCISOseries.com.

Microsoft Copilot, YouTube addresses AI uploads, CISA's AI roadmap

Microsoft goes all in on Copilot YouTube's AI disclosure requirement CISA's AI Roadmap Thanks to today's episode sponsor, Sysdig For businesses innovating in the cloud, every second counts. Sysdig strengthens cyber resilience by reducing the attack surface, detecting threats in real time, and accelerating incident response. Our platform correlates signals across cloud workloads, identities, and services to enable businesses to prioritize risks and act decisively. Sysdig. Secure every second.

IPStorm botnet dismantled, Social media giants will face child safety lawsuits, Authorities warn of Royal ransom gang threat

IPStorm botnet dismantled after hacker's guilty plea Federal court rules social media giants must face child safety lawsuits Authorities warn of Royal ransom gang's activities and rebranding Thanks to today's episode sponsor, Sysdig For businesses innovating in the cloud, every second counts. Sysdig strengthens cyber resilience by reducing the attack surface, detecting threats in real time, and accelerating incident response. Our platform correlates signals across cloud workloads, identities, and services to enable businesses to prioritize risks and act decisively. Sysdig. Secure every second. For businesses innovating in the cloud, every second counts. Sysdig strengthens cyber resilience by reducing the attack...

Cyber Security Headlines: Australian ports attacked, impacts of AI on terrorist content, Google sees faked Bard ads

Australian ports hit with cyberattack AI companies join on to Christchurch Call to Action Generative AI threatens to dismantle terrorist content detection Thanks to today's episode sponsor, Sysdig For businesses innovating in the cloud, every second counts. Sysdig strengthens cyber resilience by reducing the attack surface, detecting threats in real time, and accelerating incident response. Our platform correlates signals across cloud workloads, identities, and services to enable businesses to prioritize risks and act decisively. Sysdig. Secure every second.

China bank ransomed, UK health data shared, Boeing data published

Industrial and Commercial Bank of China suffers ransomware attack UK health data donated for medical research shared with insurance companies Boeing data published by LockBit Thanks to today's episode sponsor, Sysdig For businesses innovating in the cloud, every second counts. Sysdig strengthens cyber resilience by reducing the attack surface, detecting threats in real time, and accelerating incident response. Our platform correlates signals across cloud workloads, identities, and services to enable businesses to prioritize risks and act decisively. Sysdig. Secure every second. For the stories behind the headlines, head to CISOseries.com.

Week in Review: Okta explains hack, Google Calendar as C2, Selling military data

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted bySean Kellywith guestHoward Holton, CTO,GigaOm Thanks to today's episode sponsor, OffSec OffSec (formerly Offensive Security), the cyber training company behind the well-known OSCP certification and Kali Linux distro, is hosting a virtual summit for CISOs and Cybersecurity leaders called Evolve on November 15th. During the event, you'll learn how to attract and assess top talent, how to craft positioning for budget conversations, why CISOs make great board members, and more. Hear from forward-thinking infosec leaders from companies like CISCO, Amazon, and Salesforce. Save your seat and equip yourself...

US most breached, ChatGPT gets DDoS, Clop exploits SysAid

US most breached country last quarter OpenAI blames DDoS attacks for ongoing ChatGPT outages Clop exploits SysAid vulnerability Thanks to today's episode sponsor, OffSec And now a word from our sponsor. OffSec (formerly Offensive Security), the cyber training company behind the well-known OSCP certification and Kali Linux distro, is hosting a virtual summit for CISOs and Cybersecurity leaders called Evolve on November 15th. During the event, you'll learn how to attract and assess top talent, how to craft positioning for budget conversations, why CISOs make great board members, and more. Hear from forward-thinking infosec leaders from companies like CISCO, Amazon,...

Shields Ready campaign, AI imagery rules for the election, App Defense Alliance moves to Linux Foundation

US launches "Shields Ready" campaign Microsoft and Meta announced AI imagery rules App Defense Alliance moves under the Linux Foundation Thanks to today's episode sponsor, OffSec And now a word from our sponsor. OffSec (formerly Offensive Security), the cyber training company behind the well-known OSCP certification and Kali Linux distro, is running a virtual summit for CISOs and Cybersecurity leaders called Evolve on November 15th. Attend Evolve and get insider insights from a former bank hacker. Discover strategies on stretching your security budget and get tips to attract the crme de la crme of talent. It's more than just an...

Marina Bay Sands customer data hacked, Atlassian bug escalated to 10.0 severity, Fake crypto app steals over $700,000

Singapore's Marina Bay Sands customer data stolen in cyberattack Atlassian bug escalated to 10.0 severity Fake Ledger Live app steals over $700,000 in crypto Thanks to today's episode sponsor, OffSec And now a word from our sponsor. OffSec (formerly Offensive Security), the cyber training company behind the well-known OSCP certification and Kali Linux distro, is hosting a virtual summit for CISOs and Cybersecurity leaders called Evolve on November 15th. During the event, you'll learn how to attract and assess top talent, how to craft positioning for budget conversations, why CISOs make great board members, and more. Hear from forward-thinking infosec...

Dropper bypasses Google, CISA's zero-day worries, Google Calendar as C2

Android Dropper-as-a-Service Bypasses Google's Defenses Increase in zero-day exploits worries CISA Google Calendar as a C2 infrastructure Thanks to today's episode sponsor, OffSec And now a word from our sponsor. OffSec (formerly Offensive Security), the cyber training company behind the well-known OSCP certification and Kali Linux distro, is running a virtual summit for CISOs and Cybersecurity leaders called Evolve on November 15th. Attend Evolve and get insider insights from a former bank hacker. Discover strategies on stretching your security budget and get tips to attract the crme de la crme of talent. It's more than just an event it's a...

Okta's hack explanation, Looney Tunables exploited, Lazarus likes KandyKorn

Okta explains hack source and response timeline Looney Tunables now being exploited Lazarus Group uses KandyKorn against blockchain engineers Thanks to today's episode sponsor, OffSec And now a word from our sponsor. OffSec (formerly Offensive Security), the cyber training company behind the well-known OSCP certification and Kali Linux distro, is hosting a virtual summit for CISOs and Cybersecurity leaders called Evolve on November 15th. During the event, you'll learn how to attract and assess top talent, how to craft positioning for budget conversations, why CISOs make great board members, and more. Hear from forward-thinking infosec leaders from companies like CISCO,...

Week in Review: Cloudflare's power outage, Washington breaches, Wiki-Slack attack

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestShawn Bowen, CISO,World Kinect Corporation Thanks to our show sponsor, Hunters There's nothing worse than relying on a legacy SIEM that your security team has out-grown, especially when it impacts your ability to detect real incidents. Hunters' SOC Platform offers built-in, always up-to-date detection rules and automatic correlation that allow SOC analysts to focus on higher-value tasks that impact your organization. It's time to move to a platform that reduces risk, complexity & cost for the SOC. Visit hunters.security to learn how you can replace your...

Cloudflare's power outage, Apache HelloKitty attempt, Boeing incident continues

Power outage darkens Cloudflare dashboard and APIs Apache ActiveMQ flaw sees HelloKitty attempt Boeing says cyber incident affects parts and distribution Thanks to today's episode sponsor, Hunters There's nothing worse than relying on a legacy SIEM that your security team has out-grown, especially when it impacts your ability to detect real incidents. Hunters' SOC Platform offers built-in, always up-to-date detection rules and automatic correlation that allow SOC analysts to focus on higher-value tasks that impact your organization. It's time to move to a platform that reduces risk, complexity & cost for the SOC. Visit hunters.security to learn how you can...

UK summit pledge to tackle AI risks, 'Kill switch' shuts down Mozi botnet, EU regulator bans Meta's ad practices

Countries at UK summit pledge to tackle AI risks 'Kill switch' deliberately shuts down notorious botnet EU regulator bans Meta's targeted advertising practices Thanks to today's episode sponsor, Hunters There's nothing worse than relying on a legacy SIEM that your security team has out-grown, especially when it impacts your ability to detect real incidents. Hunters' SOC Platform offers built-in, always up-to-date detection rules and automatic correlation that allow SOC analysts to focus on higher-value tasks that impact your organization. It's time to move to a platform that reduces risk, complexity & cost for the SOC. Visit hunters.security to learn how...

Canada bans WeChat, no ransom pledge, India's opposition sees state-sponsored attacks

Canada bans WeChat on government devices 40 countries sign no ransom pledge Apple warns Indian opposition leaders about iPhone attacks Thanks to today's episode sponsor, Hunters If your SIEM is causing an endless cycle of noisy alerts, manually writing generic detection rules, and limited data ingestion & retention, your SOC might need an upgrade. Hunters is a SaaS platform, purpose built for your Security Operations team. Solaris Group, a leading German FinTech, implemented Hunters to replace their SIEM eliminating the burden of redundant detection engineering and manual event correlation. Solaris Group's SOC analysts can now focus their time and energy...

AI Executive Order, Russia' VirusTotal, Roaming leaks locations

Executive order outlines generative AI rules in the US Russia launchings its own VirusTotal Roaming data could leak geolocations Thanks to today's episode sponsor, Hunters Piecing together a SIEM not only takes forever, but it wastes your security team's valuable resources. Hunters is a SIEM alternative purpose built to help your Security Operations mature to the next level in a fraction of the time. Spontnana, a next-generation Travel-as-a-Service platform, uses Hunters' built-in correlation and enrichment capabilities to make better security decisions and experienced value from day one. Are you ready to evaluate Hunters as a SIEM alternative? Visit Hunters.security to...

DC Elections breach, LockBit Boeing breach, StripedFly's stealthy sting

DC Board of Elections breach may include entire voter roll LockBit claims Boeing breach StripedFly malware infects 1 million Windows and Linux hosts Thanks to today's episode sponsor, Hunters Hunters is a SIEM alternative, built for your security team. Hunters empowers companies to replace their SIEM with unlimited ingestion and normalization of security data at a predictable cost. Using Hunters, a CISO at a leading online retailer "tripled the amount of data ingested by her security team while cutting costs from a legacy SIEM provider by 75%." To learn more about the benefits of replacing your legacy SIEM with Hunters...

Week in Review: Okta's compromise issues, Cisco's additional headache, CISA protests cuts

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestArvin Bansal, former CISO, Nissan Americas Thanks to our show sponsor, Vanta Growing a business? That likely means more tools, third-party vendors, and data sharing AKA, way more risk. Vanta's market-leading trust management platform brings GRC and security efforts together. Integrate information from multiple systems and reduce risks to your business and your brand all without the need for additional staffing. And by automating up to 90% of the work for SOC 2, ISO 27001, and more, you'll be able to focus on strategy and security,...

iLeakage threatens Apple, CISA's catastrophic cuts, HTTP DDoS surge

ILeakage attack steals emails, passwords from Apple devices and browsers CISA protests potential 25% budget cut as "catastrophic" Surge in hyper-volumetric HTTP DDoS attacks Thanks to today's episode sponsor, Vanta Growing a business? That likely means more tools, third-party vendors, and data sharing AKA, way more risk. Vanta's market-leading trust management platform brings GRC and security efforts together. Integrate information from multiple systems and reduce risks to your business and your brand all without the need for additional staffing. And by automating up to 90% of the work for SOC 2, ISO 27001, and more, you'll be able to focus...

SMIC advanced chips, Roundcube exploit, Philadelphia email access

SMIC making advanced chips with ASML tech Roundcube webmail exploited with zero-day Philadelphia's week somehow gets worse Thanks to today's episode sponsor, Vanta Growing a business? That likely means more tools, third-party vendors, and data sharing AKA, way more risk. Vanta's market-leading trust management platform brings GRC and security efforts together. Integrate information from multiple systems and reduce risks to your business and your brand all without the need for additional staffing. And by automating up to 90% of the work for SOC 2, ISO 27001, and more, you'll be able to focus on strategy and security, not maintaining compliance....

Cisco IOS XE infections remain high, California sidelines GM's driverless cars, Canada accuse China of 'Spamouflage' campaign

Cisco IOS XE Update: Number of infected devices via zero-day remains high California sidelines GM's driverless cars, citing safety risk Canada accuse China of 'Spamouflage' disinformation campaign Thanks to today's episode sponsor, Vanta Growing a business? That likely means more tools, third-party vendors, and data sharing AKA, way more risk. Vanta's market-leading trust management platform brings GRC and security efforts together. Integrate information from multiple systems and reduce risks to your business and your brand all without the need for additional staffing. And by automating up to 90% of the work for SOC 2, ISO 27001, and more, you'll be...

Chrome IP Protection, Microsoft Security Copilot, Cisco patches IOS XE

Chrome testing IP Protection Microsoft tests Security Copilot Cisco releases IOS XE patches Thanks to today's episode sponsor, Vanta Growing a business? That likely means more tools, third-party vendors, and data sharing AKA, way more risk. Vanta's market-leading trust management platform brings GRC and security efforts together. Integrate information from multiple systems and reduce risks to your business and your brand all without the need for additional staffing. And by automating up to 90% of the work for SOC 2, ISO 27001, and more, you'll be able to focus on strategy and security, not maintaining compliance. Join 5,000 fast-growing companies...

Okta system attacked, another Cisco vulnerability, RagnarLocker arrest

Okta HAR support system attacked Cisco identifies additional IOS XE vulnerability Key Ragnar Locker player arrested in Paris Thanks to today's episode sponsor, Vanta Growing a business? That likely means more tools, third-party vendors, and data sharing AKA, way more risk. Vanta's market-leading trust management platform brings GRC and security efforts together. Integrate information from multiple systems and reduce risks to your business and your brand all without the need for additional staffing. And by automating up to 90% of the work for SOC 2, ISO 27001, and more, you'll be able to focus on strategy and security, not maintaining...

Week in Review: Water cyber-regs rescinded, Cisco zero-day attacks, Signal debunks zero-day

Link to blog post This week'sCyber Security Headlines Week in Reviewis hosted byRich Stroffolinowith guestAndrew Wilder, CISO,Community Veterinary Partners Thanks to our show sponsor, Vanta "Growing a business? That likely means more tools, third-party vendors, and data sharing AKA, way more risk. Vanta's market-leading trust management platform brings GRC and security efforts together. Integrate information from multiple systems and reduce risks to your business and your brand all without the need for additional staffing. And by automating up to 90% of the work for SOC 2, ISO 27001, and more, you'll be able to focus on strategy and security, not...

Cops sting RagnarLocker, more 23andMe leaks, Casio discloses breach

International sting operation brings down RagnarLocker More 23andMe records leaked Casio discloses data breach Huge thanks to our sponsor, Vanta Growing a business? That likely means more tools, third-party vendors, and data sharing AKA, way more risk. Vanta's market-leading trust management platform brings GRC and security efforts together. Integrate information from multiple systems and reduce risks to your business and your brand all without the need for additional staffing. And by automating up to 90% of the work for SOC 2, ISO 27001, and more, you'll be able to focus on strategy and security, not maintaining compliance. Join 5,000 fast-growing...

WinRAR exploitation, Five Eyes warns about China, ServiceNow data exposure

State-backed attackers exploit WinRAR zero-day Five Eyes warns of Chinese IP theft ServiceNow data exposure issue identified Huge thanks to our sponsor, Vanta Growing a business? That likely means more tools, third-party vendors, and data sharing AKA, way more risk. Vanta's market-leading trust management platform brings GRC and security efforts together. Integrate information from multiple systems and reduce risks to your business and your brand all without the need for additional staffing. And by automating up to 90% of the work for SOC 2, ISO 27001, and more, you'll be able to focus on strategy and security, not maintaining compliance....

Zero-day attacks affect 10,000 Cisco devices, US government warns of Confluence vuln exploitation, D-Link confirms data breach

Zero-day attacks affect over 10,000 Cisco devices US government warns of widespread exploitation of Confluence vulnerability D-Link confirms data breach caused by phishing attack Huge thanks to our sponsor, Vanta Growing a business? That likely means more tools, third-party vendors, and data sharing AKA, way more risk. Vanta's market-leading trust management platform brings GRC and security efforts together. Integrate information from multiple systems and reduce risks to your business and your brand all without the need for additional staffing. And by automating up to 90% of the work for SOC 2, ISO 27001, and more, you'll be able to focus...

Security camera warnings, Signal denies zero-day, Equifax fined in UK

Israeli government warns to secure home security cameras Signal debunks zero-day report Equifax fined for 2017 data breach Huge thanks to our sponsor, Vanta Growing a business? That likely means more tools, third-party vendors, and data sharing AKA, way more risk. Vanta's market-leading trust management platform brings GRC and security efforts together. Integrate information from multiple systems and reduce risks to your business and your brand all without the need for additional staffing. And by automating up to 90% of the work for SOC 2, ISO 27001, and more, you'll be able to focus on strategy and security, not maintaining...

CDW possibly attacked, AvosLocker joint advisory, EPA rescinds water regs

LockBit claims attack on CDW FBI and CISA publish joint advisory regarding AvosLocker ransomware EPA rescinds cyber regulations for water sector Huge thanks to our sponsor, Vanta Growing a business? That likely means more tools, third-party vendors, and data sharing AKA, way more risk. Vanta's market-leading trust management platform brings GRC and security efforts together. Integrate information from multiple systems and reduce risks to your business and your brand all without the need for additional staffing. And by automating up to 90% of the work for SOC 2, ISO 27001, and more, you'll be able to focus on strategy and...

Week in Review: Internet-wide zero-day DDoS, 23andMe data breach, curl flaw overhyped

Link to blog post This week'sCyber Security Headlines Week in Review, is hosted byRich Stroffolinowith guestMartin Choluj, VP SecurityClickHouse Thanks to our show sponsor, Hyperproof Are you struggling to showcase the value of your work? It's a classic challenge in the risk and compliance space: leadership just doesn't understand what exactly you do and why it matters. With Hyperproof, the leading risk and compliance management platform, you get access to real-time reports that can help your leadership team understand the impact of the valuable work you do every day. Get a demo at hyperproof.io. All links and the video of...

Microsoft thwarts Akira, Sullivan appeals conviction, ToddyCat targets telcos

Microsoft thwarts large-scale ransomware attack Former Uber CISO files appeal ToddyCat group targets telcos Thanks to today's episode sponsor, Hyperproof Is your company scaling? Do you need to quickly add more compliance frameworks but don't know where to start? Hyperproof has you covered. Hyperproof is a risk and compliance management platform that can help you manage compliance at scale. With Hyperproof, you can quickly add new frameworks, crosswalk controls between frameworks, view your risk posture, and manage your risks, all in one place. Visit hyperproof.io to get started today.

Hijacked 404 pages, Chinese attackers target Confluence, Adobe's "icon of transparency"

404 pages hijacked Atlassian Confluence attacked by state-backed actors Adobe's "icon of transparency" Thanks to today's episode sponsor, Hyperproof It's more critical than ever to focus on strategically addressing risk, but how can you do it when working with limited resources? That's where Hyperproof comes in: Hyperproof is a risk and compliance operations platform that helps you automate evidence collection, task management, and collaboration within your organization so you can focus on what matters most: keeping your company secure by prioritizing strategy, not manual processes. Get a demo at Hyperproof.io.

Zero-day fuels largest-ever DDoS attack, 23andMe resets user passwords after data leak, Exchange gets 'better' patch for critical bug

Internet-wide zero-day bug fuels largest-ever DDoS attack 23andMe resets user passwords after genetic data posted online Microsoft Exchange gets 'better' patch to mitigate critical bug Thanks to today's episode sponsor, Hyperproof We get it. You're a risk manager or compliance professional, and you're overworked. You're trying to do the right thing by keeping your company safe and secure, but your technology is holding you back. Why not upgrade to Hyperproof? Hyperproof is a platform that not only eliminates the manual tasks you dread, but helps you scale security. Get a demo today at hyperproof.io. For the stories behind the headlines,...

Middle East hacktivists, Curl security flaw, HelloKitty improves ransomware

Hacktivist attacks abound in the Middle East Network protocol open-source tool Curl faces worst security flaw in a long time HelloKitty ransomware source code leaked on hacking forum Thanks to today's episode sponsor, Hyperproof Imagine. You have an audit coming up, but instead of the usual rush, you actually feel prepared. You've collected your evidence. You can see which risks have been mitigated. And best of all, you don't have to send out any last-minute emails to other teams begging them for that one screenshot. Sounds like a dream, right? With Hyperproof's risk and compliance platform, this could be your...

MGM ransomware costs, Blackbaud breach settlement, 23andMe breach claims

MGM Resorts quotes ransomware tab at $110 million Blackbaud in $49.5 million settlement for May 2020 ransomware attack 23andMe investigates breach claims Thanks to today's episode sponsor, Hyperproof Tired of managing risk and compliance in spreadsheets? Sick of tracking down stakeholders to find evidence? Worried about whether that evidence is up to date for your next audit? Hyperproof has you covered. With Hyperproof, you can efficiently manage multiple compliance frameworks and risks in a single place so you can focus on what matters most: keeping your company secure and growing. Visit hyperproof.io to get a demo. For the stories behind...

Week in Review: Progress FTPbug, CloudFlare DDoS mistake, Lazarus Meta recruiters

Link to blog post This week'sCyber Security Headlines Week in Review, is hosted byRich Stroffolinowith guestBob Schuetter, CISO,Ashland Thanks to our show sponsor, Conveyor Got a scary security questionnaire to complete and you'd rather have AI do it? Your infosec friends are making the switch from outdated RFP and compliance tools to Conveyor: the most accurate security questionnaire automation software on the market. The proof is in the AI. Customers are seeing 80-90% accurate auto-generated answers by and decreasing the time spent on questionnaire answering by 91%. Try a free one-week proof of concept at www.conveyor.com. All links and the...

Apple zero-day patch, Cisco 911 patch, ICS exposure warning

Apple rolls out patch for active iOS Zero-Day Cisco patches urgent Emergency Responder flaw Researchers warn of 100,000 exposed ICS systems Thanks to our episode sponsor, Conveyor We can all agree that AI can take one job from us: answering security questionnaires. Enter Conveyor: the AI security review platform helping infosec teams attack security questionnaires from all angles. Reduce incoming questionnaires by sharing a trust portal with customers and for those questionnaires you do get, use our AI questionnaire completion tool to auto-generate precise answers to entire questionnaires in seconds. Lucid tried a free one week proof of concept and...

Red Cross hacktivist rules, Looney Tunables hit Linux, CISA violates First Amendment

Red Cross issues hacktivist rules Looney Tunables hits major Linux distros CISA may have violated the First Amendment Thanks to our episode sponsor, Conveyor Will security questionnaires ever go away? Maybe. But as long as they're still here, you might as well get AI to complete them for you. Enter Conveyor. The AI security questionnaire automation software that auto-generates 80-90% accurate answers to entire questionnaires in seconds so all you have to do is review. There's even a browser extension for the world's worst portals. Not sure if it'll work for you? Try a free one-week proof of concept at...

GPU driver exploits, EU strengthens spyware protections, NSA's AI Security Center

Arm and Qualcomm warn about exploited GPU drivers EU Parliament strengthens spyware protections for journalists NSA creates AI Security Center Thanks to our episode sponsor, Conveyor Does the mountain of security questionnaires in your inbox make you feel like a 2 dollar umbrella in a hurricane? Then you might want to check out Conveyor: the AI security review platform helping infosec teams attack security questionnaires from all angles. Reduce incoming questionnaires by sharing a trust portal with customers and for those questionnaires you do get, use our AI questionnaire completion tool to auto-generate precise answers to entire questionnaires in seconds....

Progress FTP bug under active exploit, Norway urges Europe-wide Meta data collection ban, KillNet claims attack against Royal Family website

Critical Progress FTP bug now being exploited in attacks Norway urges Europe-wide ban on Meta's targeted data collection KillNet claims DDoS attack against Royal Family website Thanks to our episode sponsor, Conveyor Got a scary security questionnaire to complete and you'd rather have AI do it? Your infosec friends are making the switch from outdated RFP and compliance tools to Conveyor: the most accurate security questionnaire automation software on the market. The proof is in the AI. Customers are seeing 80-90% accurate auto-generated answers by and decreasing the time spent on questionnaire answering by 91%. Try a free one-week proof...

Cloudflare's protection bypass, ALPHV healthcare victim, Lazarus Meta recruiter

Cloudflare DDoS protections bypassed using Cloudflare McLaren Health Care becomes latest ALPHV/BlackCat victim Lazarus Group poses as Meta recruiters to spearfish Spanish engineers Thanks to our episode sponsor, Conveyor Does the thought of answering another security questionnaire make you want to beat the stuffing out of 32 pinatas? Then you might want to check out Conveyor: the AI security review platform helping infosec and sales teams attack security questionnaires from all angles. Reduce incoming questionnaires by sharing a trust portal with customers and for those questionnaires you do get, use our AI questionnaire completion tool to auto-generate precise answers to...

Week in Review: New MOVEIt troubles, fallout from government email breach, H&R Block faces RICO charges

Link to blog post This week'sCyber Security Headlines Week in Review, is hosted byRich Stroffolinowith guestAndrew Storms, VP of security,Replicated Thanks to our show sponsor, AppOmni Are you confident in your organization's SaaS security? AppOmni surveyed 600+ security practitioners globally and 71% answered yes. But 79% experienced SaaS cybersecurity incidents. What's behind this disconnect? CISOs believe they have a mature level of SaaS cybersecurity using CASB, MFA, and IdP. But these solutions lack unified risk visibility. Without SSPM, they're blind to the true extent of their SaaS attack surface risk. Don't gamble with your data. Get the visibility and insights...

Government email damage, Johnson Controls attacked, Google's 5th zero-day

Chinese hackers stole emails from US State Dept in Microsoft breach Johnson Controls faces $51 million ransomware demand Google fixes year's fifth Chrome zero-day Thanks to today's episode sponsor, AppOmni If you think CASBs effectively secure your SaaS data think again. CASBs lack visibility into your SaaS estate. Nor can they address and detect risks that arise from SaaS apps' unlimited endpoints. What you need is a robust SSPM designed to secure the dynamic and extensible nature of SaaS apps and their data. That's where AppOmni comes in. We continuously monitor your SaaS estate to detect cyber risks and secure...

GPU pixel-stealing, info-stealing on GitHub, Sony hackers hit NTT Docomo

GPUs vulnerable to pixel-stealing attacks Info-stealing commits hit GitHub Alleged Sony hackers hit NTT Docomo Thanks to today's episode sponsor, AppOmni Are you confident in your organization's SaaS security? AppOmni surveyed 600+ security practitioners globally and 71% answered yes. But 79% experienced SaaS cybersecurity incidents. What's behind this disconnect? CISOs believe they have a mature level of SaaS cybersecurity using CASB, MFA, and IdP. But these solutions lack unified risk visibility. Without SSPM, they're blind to the true extent of their SaaS attack surface risk. Don't gamble with your data. Get the visibility and insights you need to protect your...

Multiple threat actors lay claim to Sony hack, Philippines health org struggling with ransomware recovery, Flair Airlines leaked user data for months

Multiple threat actors lay claim to Sony hack Philippines health org struggling to recover from ransomware attack Canadian Flair Airlines leaked user data for months Thanks to today's episode sponsor, AppOmni If you think CASBs effectively secure your SaaS data think again. CASBs lack visibility into your SaaS estate. Nor can they address and detect risks that arise from SaaS apps' unlimited endpoints. What you need is a robust SSPM designed to secure the dynamic and extensible nature of SaaS apps and their data. That's where AppOmni comes in. We continuously monitor your SaaS estate to detect cyber risks and...

Mixin Network breach, Kia and Hyundai thefts explode, stress testing voting equipment

Mixin Network loses $200 million Kia and Hyundai exploit linked to massive car thefts Stress testing voting equipment Thanks to today's episode sponsor, AppOmni Are you confident in your organization's SaaS security? AppOmni surveyed 600+ security practitioners globally and 71% answered yes. But 79% experienced SaaS cybersecurity incidents. What's behind this disconnect? CISOs believe they have a mature level of SaaS cybersecurity using CASB, MFA, and IdP. But these solutions lack unified risk visibility. Without SSPM, they're blind to the true extent of their SaaS attack surface risk. Don't gamble with your data. Get the visibility and insights you need...

Clarion audio hacked, Egyptian Predator threat, Dallas cyberattack analysis

Car audio manufacturer Clarion hacked ALPHV claims responsibility High-ranking Egyptian politician targeted by Predator spyware City of Dallas issues report on May cyberattack Thanks to today's episode sponsor, AppOmni If you think CASBs effectively secure your SaaS data think again. CASBs lack visibility into your SaaS estate. Nor can they address and detect risks that arise from SaaS apps' unlimited endpoints. What you need is a robust SSPM designed to secure the dynamic and extensible nature of SaaS apps and their data. That's where AppOmni comes in. We continuously monitor your SaaS estate to detect cyber risks and secure your...

Week in Review: UK and US cyberlaws, Microsoft's bad week, Cisco buys Splunk

Link to blog post This week'sCyber Security Headlines Week in Review, is hosted byRich Stroffolinowith guestShawn Bowen, CISO,World Kinect Corporation Thanks to our show sponsor, Hyperproof Is your company scaling? Do you need to quickly add more compliance frameworks but don't know where to start? Hyperproof has you covered. Hyperproof is a risk and compliance management platform that can help you manage compliance at scale. With Hyperproof, you can quickly add new frameworks, crosswalk controls between frameworks, view your risk posture, and manage your risks, all in one place. Visit hyperproof.io to get started today. All links and the video...

UK's new cyberlaws, Cisco buys Splunk, Transunion denies breach

UK launches comprehensive new online safety laws Cisco buys Splunk TransUnion denies breach Huge thanks to our sponsor, Hyperproof Is your company scaling? Do you need to quickly add more compliance frameworks but don't know where to start? Hyperproof has you covered. Hyperproof is a risk and compliance management platform that can help you manage compliance at scale. With Hyperproof, you can quickly add new frameworks, crosswalk controls between frameworks, view your risk posture, and manage your risks, all in one place. Visit hyperproof.io to get started today. For the stories behind the headlines, head to CISOseries.com.

Canadian airport DDoS, Huawei ships chips, Signal goes post-quantum

Cyber attack disrupted Canadian airports Huawei ships chips for surveillance cameras Signal adds quantum-resistant encryption Huge thanks to our sponsor, Hyperproof It's more critical than ever to focus on strategically addressing risk, but how can you do it when working with limited resources? That's where Hyperproof comes in: Hyperproof is a risk and compliance operations platform that helps you automate evidence collection, task management, and collaboration within your organization so you can focus on what matters most: keeping your company secure by prioritizing strategy, not manual processes. Get a demo at Hyperproof.io.

DHS to simplify cyber incident reporting rules, UK passes Online Safety Bill, PIILOPUOTI marketplace takedown

DHS council seeks to simplify cyber incident reporting rules UK passes the Online Safety Bill Finland and Europol take down PIILOPUOTI marketplace Huge thanks to our sponsor, Hyperproof We get it. You're a risk manager or compliance professional, and you're overworked. You're trying to do the right thing by keeping your company safe and secure, but your technology is holding you back. Why not upgrade to Hyperproof? Hyperproof is a platform that not only eliminates the manual tasks you dread, but helps you scale security. Get a demo today at hyperproof.io. For the stories behind the headlines, visit CISOseries.com.

Microsoft leaks AI data, UK CMA AI principles, Germany warns of natural gas terminal attacks

Microsoft leaks terabytes of internal data UK CMA outlines principles for AI regulation Germany warns of attacks on LNG terminals Huge thanks to our sponsor, Hyperproof Imagine. You have an audit coming up, but instead of the usual rush, you actually feel prepared. You've collected your evidence. You can see which risks have been mitigated. And best of all, you don't have to send out any last-minute emails to other teams begging them for that one screenshot. Sounds like a dream, right? With Hyperproof's risk and compliance platform, this could be your reality. Get a demo at hyperproof.io.

Lazarus hit CoinX, Thailand's CardX breach, trucking software attack

Lazarus Group suspected in CoinEx robbery Thailand financial company CardX discloses leak Ransomware hits trucking software provider Huge thanks to our sponsor, Hyperproof Tired of managing risk and compliance in spreadsheets? Sick of tracking down stakeholders to find evidence? Worried about whether that evidence is up to date for your next audit? Hyperproof has you covered. With Hyperproof, you can efficiently manage multiple compliance frameworks and risks in a single place so you can focus on what matters most: keeping your company secure and growing. Visit hyperproof.io to get a demo. For the stories behind the headlines, head to CISOseries.com.

Week in Review: Las Vegas heists, mental health, Tesla's no-hands option

Link to blog post This week'sCyber Security Headlines Week in Review, is hosted byRich Stroffolinowith guest Davi Ottenheimer, VP, Trust and Ethics,Inrupt Thanks to our show sponsor, Conveyor The team at Lucid software reduced the time spent answering customer security questionnaires by a whopping 91% with Conveyor's security questionnaire automation software powered by OpenAI. Compared to the tools on the market, Conveyor's AI auto-generates the most accurate answers to entire questionnaires so you can spend almost zero time on them. That's it. That's the ad. We'll let you get back to the show, but if you want to take away...

Caesars, MGM attacks, Weather Network down, LockBit dual deployment

Caesars reportedly paid millions to stop Scattered Spider Cybersecurity incident impacts Canada's Weather Network Blocked LockBit affiliate deploys 3AM instead Huge thanks to our sponsor, Conveyor The team at Lucid software reduced the time spent answering customer security questionnaires by a whopping 91% with Conveyor's security questionnaire automation software - powered by OpenAI. Compared to the tools on the market, Conveyor's AI auto-generates the most accurate answers to entire questionnaires so you can spend almost zero time on them. That's it. That's the ad. We'll let you get back to the headlines, but if you want to take away the...

US asks to not pay ransoms, CISA's open source roadmap, Save the Children ransomware attack

NSC asks governments not to pay ransoms CISA's open source software security roadmap Save the Children hit with ransomware Huge thanks to our sponsor, Conveyor Got a scary security questionnaire to complete and you'd rather have AI do it? Your infosec friends are making the switch from outdated RFP and compliance tools to Conveyor - the most accurate security questionnaire automation software on the market. The proof is in the AI. Customers are seeing 80-90% accurate answers and decreasing the time spent on questionnaire answering by 91%. We're excited about the success customers like Lucid and Carta have seen using...

MGM Resorts "cybersecurity incident", Hackers access Airbus vendor info, Cryptoqueen's sidekick sentenced

MGM Resorts slot machines and ATMs disrupted by "cybersecurity incident" Hackers access sensitive data of thousands of Airbus vendors Cryptoqueen's sidekick sentenced for $4 billion scam Huge thanks to our sponsor, Conveyor Here's how to measure if your security questionnaire answering software is effective. We benchmarked the RFP and compliance tools on the market and most are only generating accurate responses to questionnaires 20-50% of the time. Ready for 80-90% auto-generated accurate answers so you can fly through your review? Then you should try Conveyor's AI-security questionnaire automation tool. Don't believe us? Try a free proof of concept at www.conveyor.com...

Rising infrastructure attacks, Sponsor backdoor, Sri Lanka loses data in attack

UK government sees record critical IT infrastructure attacks Charming Kitten unleashes Sponsor backdoor Ransomware costs Sri Lankan government months of data Huge thanks to our sponsor, Conveyor The team at Lucid software reduced the time spent answering customer security questionnaires by a whopping 91% with Conveyor's security questionnaire automation software - powered by OpenAI. Compared to the tools on the market, Conveyor's AI auto-generates the most accurate answers to entire questionnaires so you can spend almost zero time on them. That's it. That's the ad. We'll let you get back to the headlines, but if you want to take away...

Fake Telegram apps, Akamai defeats mega-DDoS, Rhysida hospital attacks

Evil Telegram fake apps send spyware Akamai announces mitigation of largest DDoS on a US financial company Rhysida attacks three more hospitals Huge thanks to our sponsor, Conveyor What's scarier than the Sunday scaries? Opening your inbox to a 200 question, 15 tab macro-enabled workbook containing a customer security questionnaire to complete. Let Conveyor's AI security questionnaire automation tool, powered by OpenAI, help your answering process go a lot faster. Spend 91% less time on questionnaires when you get precise answers auto-generated for you. Try a free proof of concept to see how fast you can get through questionnaires with...

Week in Review: Microsoft MSA answers, Keystroke monitoring software, G-Man Mudge

Link to blog post This week'sCyber Security Headlines Week in Review, is hosted byRich Stroffolinowith guestDan Walsh, CISO,VillageMD Thanks to our show sponsor, Comcast DataBee DataBee, from Comcast Technology Solutions, is a cloud-native security, risk and compliance data fabric platform that transforms your security data chaos into connected outcomes. Built by security professionals for security professionals, DataBee makes your data a gold mine, rich with information that enables you to examine the past, react to the present, and protect the future of your business. Learn more at https://comca.st/DataBee. All links and the video of this episode can be found on...

China's MSA key hack, cyberwar crimes, North Korea targeting Russia

How Chinese hackers stole a Microsoft signing key The ICC to prosecute cyberwar crimes North Korean cyberattacks against Russian targets Thanks to today's episode sponsor, Comcast DataBee, from Comcast Technology Solutions, is a cloud-native security, risk and compliance data fabric platform that transforms your security data chaos into connected outcomes. Built by security professionals for security professionals, DataBee makes your data a gold mine, rich with information that enables you to examine the past, react to the present, and protect the future of your business. Learn more at https://comca.st/DataBee.

CISA reporting rules, LastPass key crack, connected cars fail on privacy

CISA close to finalizing incident reporting rules Krebs on cracked LastPass keys Connected cars not great for privacy and security Thanks to today's episode sponsor, Comcast Are you still using whiteboards and pivoting between tools to find out who owns what data sources and the relationships between data points? It's time to improve your OODA loop and enhance your security and compliance efforts with DataBee, from Comcast Technology Solutions. Learn how DataBee weaves together and enriches data from across the enterprise to provide deeper insights into your security, risk and compliance posture. Visit https://comca.st/DataBee.

CISA hires 'Mudge', Call for Congress to address AI-generated CSAM, Stake.com loses $41 million in crypto

CISA hires 'Mudge' to work on security-by-design principles All 50 states call on Congress to address AI-generated CSAM Stake.com loses $41 million to hot wallet hackers Thanks to today's episode sponsor, Comcast What if you could integrate enterprise-wide business intelligence with your security data for better contextual insights into potential threats and compliance issues? You can. With DataBee, from Comcast Technology Solutions. Learn how DataBee enables users to leverage integrated insights to mitigate risks and stay compliant. Visit https://comca.st/DataBee. For the stories behind the headlines, visit CISOseries.com.

PDF MalDoc warning, MinIO storage compromises, Okta helpdesk attacks

New PDF MalDoc allows evasion of antivirus MinIO Storage system being used to compromise servers Okta warns of IT help desk attacks Thanks to today's episode sponsor, Comcast Data rules everything around us but why are the people who need data the most unable to access it? What if you could boost the productivity of your security teams and their ability to collaborate by providing them access to the same shared and enriched data? You can. With DataBee, from Comcast Technology Solutions. Learn how DataBee can help your organization make better informed decisions, quickly and cost-effectively. Visit https://comca.st/DataBee For the...

X collects employment histories, Sandworm Chisel analysis, Callaway breach

X to collect member employment data Technical details of Sandworm malware 'Infamous Chisel' released Golf club maker Callaway suffers breach Thanks to today's episode sponsor, Comcast DataBee "Data is the currency of the 21st century", yet for so many cybersecurity professionals, it's still too difficult to access, correlate and use this 'currency' for better, faster security and compliance decision-making. That's why Comcast Technology Solutions created DataBee, a cloud-native security data fabric platform that can help you turn your security data into valuable business 'currency'. Learn more at https://comca.st/DataBee. For the stories behind the headlines, head to CISOseries.com.

Gamaredon hits Ukraine, Paramount suffers breach, OpenFire gets swarmed

Gamaredon hackers hit Ukraine military Movie giant Paramount Global suffers data breach Takeover swarm exploits OpenFire Huge thanks to today's episode sponsor, AppOmni Over provisioned users could lead to your most sensitive data being exposed or leaked. Just a single attack on one of those users may compromise your entire SaaS estate. With AppOmni's SaaS Identity Fabric, secure and manage end-users, entitlements, and threat-based activity. Gain visibility and control over provisioned users, the SaaS data they have access to, and receive guided remediation. Get connected with SaaS security experts at AppOmni.com. For the stories behind the headlines, head to CISOseries.com.

China hacked Japan's NISC, trafficking fuels cyber scams, China approves generative AI

Chinese threat actors breached Japan's cybersecurity agency Human trafficking into cyber scams China set to approve first generative AI services Huge thanks to today's episode sponsor, AppOmni SaaS cyberattacks are prevalent and often go unnoticed until data loss or breaches occur. Sign-ins from an unusual IP address. Stolen session tokens. These security risks can lurk in the shadows and put your entire SaaS estate at risk. Don't wait for a breach to secure your SaaS data. AppOmni helps security teams to detect suspicious activity, decide what activities to be alerted on, and receive guided remediation. Learn how at AppOmni.com.

FBI dismantles Qakbot operation, University of Michigan cuts internet after cyberattack, Microsoft criticizes UN cybercrime treaty

FBI dismantles Qakbot operation that took millions in ransom University of Michigan severs ties to internet after cyberattack Microsoft joins growing list of organizations criticizing UN cybercrime treaty Huge thanks to today's episode sponsor, AppOmni Over provisioned users could lead to your most sensitive data being exposed or leaked. Just a single attack on one of those users may compromise your entire SaaS estate. With AppOmni's SaaS Identity Fabric, secure and manage end-users, entitlements, and threat-based activity. Gain visibility and control over provisioned users, the SaaS data they have access to, and receive guided remediation. Get connected with SaaS security...

UK flight outage, the malware Big 3, spyware firm breached

UK network outage grounds flights The malware loader Big 3 Another spyware firm breached Huge thanks to today's episode sponsor, AppOmni SaaS cyberattacks are prevalent and often go unnoticed until data loss or breaches occur. Sign-ins from an unusual IP address. Stolen session tokens. These security risks can lurk in the shadows and put your entire SaaS estate at risk. Don't wait for a breach to secure your SaaS data. AppOmni helps security teams to detect suspicious activity, decide what activities to be alerted on, and receive guided remediation. Learn how at AppOmni.com.

Cisco fixes flaws, Windows BSOD reappears, FBI Barracuda warning

Cisco fixes flaws in NX-OS AND FXOS software Windows preview updates bring blue screen of death FBI warns Barracuda bug still has bite Huge thanks to today's episode sponsor, AppOmni Over provisioned users could lead to your most sensitive data being exposed or leaked. Just a single attack on one of those users may compromise your entire SaaS estate. With AppOmni's SaaS Identity Fabric, secure and manage end-users, entitlements, and threat-based activity. Gain visibility and control over provisioned users, the SaaS data they have access to, and receive guided remediation. Get connected with SaaS security experts at AppOmni.com. For the...

Week in Review: Health hackers evolve, generative AI cyberattacks, NK spooks drills

Link to blog post This week'sCyber Security Headlines Week in Review, is hosted byRich Stroffolinowith guestGerald Auger Ph.D., Chief Content Creator, Simply Cyber Thanks to our show sponsor, HyperProof Is your company scaling? Do you need to quickly add more compliance frameworks but don't know where to start? Hyperproof has you covered. Hyperproof is a risk and compliance management platform that can help you manage compliance at scale. With Hyperproof, you can quickly add new frameworks, crosswalk controls between frameworks, view your risk posture, and manage your risks, all in one place. Visit hyperproof.io to get started today. All links...

Lazarus exploits ManageEngine, Rockwell ThinManager vulnerabilities, Mississippi hospital attack

Lazarus Group exploits ManageEngine to drop new RATS on internet and healthcare Vulnerabilities in Rockwell ThinManager threaten industrial control systems Mississippi hospital system suffers cyberattack Huge thanks to our sponsor, HyperProof Is your company scaling? Do you need to quickly add more compliance frameworks but don't know where to start? Hyperproof has you covered. Hyperproof is a risk and compliance management platform that can help you manage compliance at scale. With Hyperproof, you can quickly add new frameworks, crosswalk controls between frameworks, view your risk posture, and manage your risks, all in one place. Visit to get started today. For...

Tornado Cash indictment, UN cybercrime treaty, Lazarus crypto cashout

Tornado Cash developers face indictment UN begins final cybercrime treaty talks FBI warns of North Korean crypto cash out Huge thanks to our sponsor, HyperProof It's more critical than ever to focus on strategically addressing risk, but how can you do it when working with limited resources? That's where Hyperproof comes in: Hyperproof is a risk and compliance operations platform that helps you automate evidence collection, task management, and collaboration within your organization so you can focus on what matters most: keeping your company secure by prioritizing strategy, not manual processes. Get a demo at Hyperproof.io.

CISOs' cybersecurity confidence, Healthcare cyberbreach report, Duo outage

CISOs proclaim cybersecurity confidence, but majority admit to SaaS incidents Cyber Health Report: Hacker entry point shifts from email to network Duo outage causes Azure Auth authentication errors Huge thanks to our sponsor, HyperProof We get it. You're a risk manager or compliance professional, and you're overworked. You're trying to do the right thing by keeping your company safe and secure, but your technology is holding you back. Why not upgrade to Hyperproof? Hyperproof is a platform that not only eliminates the manual tasks you dread, but helps you scale security. Get a demo today at hyperproof.io. For the stories...

ChatGPT botnet, Brits tip ransomware targets, Tesla's insider breach

ChatGPT used in crypto botnet Brits tipping off ransomware targets Tesla data breach caused by insiders Huge thanks to our sponsor, HyperProof Imagine. You have an audit coming up, but instead of the usual rush, you actually feel prepared. You've collected your evidence. You can see which risks have been mitigated. And best of all, you don't have to send out any last-minute emails to other teams begging them for that one screenshot. Sounds like a dream, right? With Hyperproof's risk and compliance platform, this could be your reality. Get a demo at hyperproof.io.

NK attacks drills, Android APK malware, space industry warning

North Korean hackers suspected of targeting S. Korea-US drills Android malware apps use APK compression to evade detection Security agencies warn space industry of increased attacks Huge thanks to our sponsor, HyperProof Tired of managing risk and compliance in spreadsheets? Sick of tracking down stakeholders to find evidence? Worried about whether that evidence is up to date for your next audit? Hyperproof has you covered. With Hyperproof, you can efficiently manage multiple compliance frameworks and risks in a single place so you can focus on what matters most: keeping your company secure and growing. Visit hyperproof.io to get a demo....

Week in Review: Ford WiFi vulnerability, LockBit's publication struggle, Government ZeroTrust confidence

Link to blog post This week'sCyber Security Headlines Week in Review, is hosted byRich Stroffolinowith guest,Jon Oltsik, distinguished analyst and fellow,Enterprise Strategy Group Thanks to our show sponsor, Veza 75% of breaches happen because of bad permissions. The problem is that you don't know exactly WHO has access to WHAT data in your environment. For example, roles labeled as "read-only" can often edit and delete sensitive data. Veza automatically finds and fixes every bad permissionin every appacross your environment. All links and the video of this episode can be found on CISO Series.com

Cybercriminals finetune AI, Government ZeroTrust confidence, Citrix vulnerability warning

Influence operators fine-tuning AI to deceive targets 67% of government agencies claim confidence in adopting zero trust CISA warns of urgent Citrix vulnerability Huge thanks to today's episode sponsor, Veza 75% of breaches happen because of bad permissions. The problem is that you don't know exactly WHO has access to WHAT data in your environment. For example, roles labeled as "read-only" can often edit and delete sensitive data. Veza automatically finds and fixes every bad permissionin every appacross your environment. For the stories behind the headlines, head to CISOseries.com.

LockBit struggles, Google's quantum resilient key, orgs excitedly unprepared for AI

LockBit struggles to publish leaked data Google's quantum resilient security key Organizations optimistic and unprepared for AI Huge thanks to today's episode sponsor, Veza 75% of breaches happen because of bad permissions. The problem is that you don't know exactly WHO has access to WHAT data in your environment. For example, roles labeled as "read-only" can often edit and delete sensitive data. Veza automatically finds and fixes every bad permissionin every appacross your environment.

LinkedIn accounts hijacked, Chinese spies hack US congressman's email, US watchdog plans to regulate data brokers

Huge thanks to today's episode sponsor, Veza 75% of breaches happen because of bad permissions. The problem is that you don't know exactly WHO has access to WHAT data in your environment. For example, roles labeled as "read-only" can often edit and delete sensitive data. Veza automatically finds and fixes every bad permissionin every appacross your environment. For the stories behind the headlines, visit CISOseries.com.

Moovit bug, Black Hat's NOC, DDoS origins

Moovit bug allowed for free rides A look at Black Hat's network operations center Business and gaming disputes lead to DDoS attacks Huge thanks to today's episode sponsor, Veza 75% of breaches happen because of bad permissions. The problem is that you don't know exactly WHO has access to WHAT data in your environment. For example, roles labeled as "read-only" can often edit and delete sensitive data. Veza automatically finds and fixes every bad permissionin every appacross your environment.

Ford WiFi vulnerability, Government reviews Azure hack, TripAdvisor ransomware

Ford says cars with WiFi vulnerability still safe to drive Cyber Safety Review Board to analyze cloud security in wake of Microsoft hack Knight ransomware distributed in fake TripAdvisor complaint emails Huge thanks to today's episode sponsor, Veza 75% of breaches happen because of bad permissions. The problem is that you don't know exactly WHO has access to WHAT data in your environment. For example, roles labeled as "read-only" can often edit and delete sensitive data. Veza automatically finds and fixes every bad permissionin every appacross your environment. For the stories behind the headlines, head to CISOseries.com.

Week in Review: Microsoft slapped by Tenable, Tampa Hospital lawsuit, Zoom's AI decision

Link to blog post This week'sCyber Security Headlines Week in Review, August 7-11, is hosted byRich Stroffolinowith guest,Michael Woods, CISO,GE Thanks to our show sponsor, Conveyor We can all agree there's one thing the AI bots can take from us: completing customer security questionnaires. That's why we built Conveyor's GPT-questionnaire response tool. It auto-generates precise, accurate answers to entire questionnaires with accuracy far superior to existing tools on the market. It's so accurate, your customers can now use it in our new 'upload questions to trust portal' feature. It's exactly as it sounds. Customers can upload questions and the AI...

CISA's .NET warning, Compellent exposes VMWare, DEFCON AI challenge

CISA Warns organizations of exploited vulnerability affecting .NET, Visual Studio Dell Compellent hardcoded key exposes VMware vCenter admin creds DEF CON: Thousands of security researchers vie to outsmart AI in Las Vegas Thanks to today's episode sponsor, Conveyor We can all agree there's one thing the AI bots can take from us: completing customer security questionnaires. That's why we built Conveyor's GPT-questionnaire response tool. It auto-generates precise, accurate answers to entire questionnaires with accuracy far superior to existing tools on the market. It's so accurate, your customers can now use it in our new 'upload questions to trust portal' feature....

AI Cyber Challenge, eavesdropping typing app, Android cellular security

AI Cyber Challenge announced at Black Hat Tencent typing app had real time "eavesdropper" Google adds cellular security to Android Thanks to today's episode sponsor, Conveyor Your scariest questionnaires that are HUNDREDS of questions long are no match for Conveyor's GPT-security questionnaire tool - the most accurate questionnaire automation tool on the market. It's so accurate that you can even let customers upload their own questions in your portal to get instant answers generated from your content. For questionnaires you still need complete, infosec and sales teams are spending 89% less time on answering questionnaires because they're getting accurate answers...

Google's Messages app now encrypts chats, Electoral Commission apologizes to UK voters, Banks hit with fines for using chat apps

Google's Messages app now uses RCS to encrypt chats Electoral Commission apologizes for security breach involving UK voters' data Banks hit with over $500 million in fines for using out-of-band chat apps Thanks to today's episode sponsor, Conveyor Did you catch the biggest release of the year? No, not Barbenheimer. It's Conveyor's GPT-powered security questionnaire response tool: the most accurate questionnaire automation tool on the market. It's so good, you can let your customers upload their own questions in your trust portal to get instant answers based on your content. And of course, it's not just for your customers. You...

K-12 cyber initiatives, Russian missile contractor breached, LLMs getting worse

White House rolls out school cyber initiatives North Koreans breach Russian missile developer Large language models getting worse at math Thanks to today's episode sponsor, Conveyor GPT for security questionnaires? Conveyor has already built that for you. Conveyor's GPT-questionnaire response tool is so accurate, you can use it in two ways. One: Let your customers upload their own questions in your trust portal to get AI-generated answers based on the content in your portal. And Two: It's not just for your customers. You can use the GPT-questionnaire response tool internally as well to get auto-generated precise answers to entire questionnaires...

Tenable smacks Microsoft, hospital ransomware attacks, accurate acoustic spyware

Microsoft resolves vulnerability following criticism from Tenable CEO FBI investigating ransomware attack crippling hospitals across 4 states New acoustic attack steals data from keystrokes with 95% accuracy Thanks to today's episode sponsor, Conveyor Did you catch the biggest release of the year? No, not Barbenheimer. It's Conveyor's GPT-powered security questionnaire response tool: the most accurate questionnaire automation tool on the market. It's so good, you can let your customers upload their own questions in your trust portal to get instant answers based on your content. And of course, it's not just for your customers. You can use the GPT-questionnaire response...

Week in Review: IDOR vulnerability warning, Israel refinery cyberattack, spies bemoan AI training

Link to Blog Post This week'sCyber Security Headlines Week in Review, July 31-August 4, is hosted byRich Stroffolinowith guest,Jeff Hudesman, CISO,Pinwheel Thanks to our show sponsor, Opal Opal is the data-centric identity platform. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower enterprises to understand and calibrate access end to end. The best security teams from companies like Databricks, Figma, Blend, and Drata use Opal to build identity security for scale. Visit opal.dev.

Fortinet tops vuln list, malicious Chrome Rilite, more Ivanti issues

Fortinet VPN bug tops CISA's list of most exploited vulnerabilities in 2022 Chrome malware Rilide targets enterprise users via PowerPoint guides Researchers discover bypass for recently fixed Ivanti EPMM vulnerability Thanks to today's episode sponsor, Opal Opal is the data-centric identity platform. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower enterprises to understand and calibrate access end to end. The best security teams from companies like Databricks, Figma, Blend, and Drata use Opal to build identity security for scale. Visit Opal.dev. For the stories behind the headlines, head to...

Australia considers WeChat ban, US company aiding APTs, Veilid coming to DEF CON

Australian Senate recommends banning WeChat US company accused of aiding APT Hacking group to detail P2P protocol at DEF CON Thanks to today's episode sponsor, Opal Opal is the data-centric identity platform. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower enterprises to understand and calibrate access end to end. The best security teams from companies like Databricks, Figma, Blend, and Drata use Opal to build identity security for scale. Visit Opal.dev.

Musk sues disinformation researchers, Cloud host found facilitating state-backed cyberattacks, UK spy agencies want to relax 'burdensome' AI laws

Musk sues disinformation researchers for driving away advertisers Researchers claim cloud host facilitated state-backed cyberattacks UK spy agencies want to relax 'burdensome' laws on AI data use Thanks to today's episode sponsor, Opal Opal is the data-centric identity platform. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower enterprises to understand and calibrate access end to end. The best security teams from companies like Databricks, Figma, Blend, and Drata use Opal to build identity security for scale. Visit Opal.dev. For the stories behind the headlines, visit CISOseries.com.

National plan for cyber education, DeFi code exploit, study on cyber insurance

White House releases National Cyber and Workforce Education Strategy Latest DeFi exploit sees millions in losses No link found between cyber insurance and paying ransoms Thanks to today's episode sponsor, Opal Opal is the data-centric identity platform. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower enterprises to understand and calibrate access end to end. The best security teams from companies like Databricks, Figma, Blend, and Drata use Opal to build identity security for scale. Visit Opal.dev.

Israel refinery cyberattack, TSA pipeline guidelines, CISA's IDOR warning

Israel's largest oil refinery website offline amid cyber attack claims TSA renews cybersecurity guidelines for pipelines CISA AND Australia warn of IDOR vulnerabilities after major breaches Thanks to today's episode sponsor, Opal Opal is the data-centric identity platform. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower enterprises to understand and calibrate access end to end. The best security teams from companies like Databricks, Figma, Blend, and Drata use Opal to build identity security for scale. Visit Opal.dev. For the stories behind the headlines, head to CISOseries.com.

Week in Review: Stolen Microsoft key, government Maximus breach, Clop on clearweb

Link to Blog Post This week'sCyber Security Headlines Week in Review, July 24-28, is hosted byRich Stroffolinowith guest,TC Niedzialkowski, CISO,Nextdoor Thanks to today's episode sponsor, AppOmni Over provisioned users could lead to your most sensitive data being exposed or leaked. Just a single attack on one of those users may compromise your entire SaaS estate. With AppOmni's SaaS Identity Fabric, secure and manage end-users, entitlements, and threat-based activity. Gain visibility and control over provisioned users, the SaaS data they have access to, and receive guided remediation. Get connected with SaaS security experts at AppOmni.com. All links and the video of...

Maximus breach, Ubuntu Linux vulnerabilities, Cardio company cyberattack

Millions affected by data breach at US government contractor Maximus Two severe Linux vulnerabilities impact 40% of Ubuntu users Heart monitoring technology provider confirms cyberattack Thanks to today's episode sponsor, AppOmni Over provisioned users could lead to your most sensitive data being exposed or leaked. Just a single attack on one of those users may compromise your entire SaaS estate. With AppOmni's SaaS Identity Fabric, secure and manage end-users, entitlements, and threat-based activity. Gain visibility and control over provisioned users, the SaaS data they have access to, and receive guided remediation. Get connected with SaaS security experts at AppOmni.com. For...

Cyber exec convicted, SEC disclosure, how the government gets breached

Russian court convicts cyber security executive of treason SEC to require incident disclosure Government cyber attacks rely on valid credentials Thanks to today's episode sponsor, AppOmni SaaS cyberattacks are prevalent and often go unnoticed until data loss or breaches occur. Sign-ins from an unusual IP address. Stolen session tokens. These security risks can lurk in the shadows and put your entire SaaS estate at risk. Don't wait for a breach to secure your SaaS data. AppOmni helps security teams to detect suspicious activity, decide what activities to be alerted on, and receive guided remediation. Learn how at AppOmni.com.

TETRA encryption flaws, Zenbleed strikes, Norway's government hit with Ivanti flaw

Vulnerability found in TETRA encryption Ryzen CPUs vulnerable to Zenbleed exploit Norwegian government breached with Ivanti zero-day Thanks to today's episode sponsor, AppOmni Over provisioned users could lead to your most sensitive data being exposed or leaked. Just a single attack on one of those users may compromise your entire SaaS estate. With AppOmni's SaaS Identity Fabric, secure and manage end-users, entitlements, and threat-based activity. Gain visibility and control over provisioned users, the SaaS data they have access to, and receive guided remediation. Get connected with SaaS security experts at AppOmni.com.

Cyber Security Headlines: Clop leaks on clearweb, EU pushes back on CSA centralization, rising data breach costs

Clop moves leaked data to clearweb sites EU governments push back on centralized cyber reporting Cost of data breaches up 15% Thanks to today's episode sponsor, AppOmni SaaS cyberattacks are prevalent and often go unnoticed until data loss or breaches occur. Sign-ins from an unusual IP address. Stolen session tokens. These security risks can lurk in the shadows and put your entire SaaS estate at risk. Don't wait for a breach to secure your SaaS data. AppOmni helps security teams to detect suspicious activity, decide what activities to be alerted on, and receive guided remediation. Learn how at AppOmni.com.

Azure hack deepens, JumpCloud is Lazarus, DHL MOVEIt victim

Microsoft key stolen by Chinese hackers provided access far beyond Outlook JumpCloud breach traced back to North Korean state hackers DHL investigating MOVEit breach as number of victims surpasses 20 million Thanks to today's episode sponsor, AppOmni Over provisioned users could lead to your most sensitive data being exposed or leaked. Just a single attack on one of those users may compromise your entire SaaS estate. With AppOmni's SaaS Identity Fabric, secure and manage end-users, entitlements, and threat-based activity. Gain visibility and control over provisioned users, the SaaS data they have access to, and receive guided remediation. Get connected with...

Week in Review: Fast acting Gamaredon, WormGPT AI weapon, Microsoft Azure mystery

Link to Blog Post This week'sCyber Security Headlines Week in Review, July 17-21, is hosted byRich Stroffolinowith our guest,Dimitri van Zantvliet, CISO,Dutch Railways Thanks to our show sponsor, OpenVPN According to Oriel Hernan Villalba Pinzetta, a System Administrator with CEDEC's cybersecurity and IT department, "The pandemic meant we could not come to the office, and we needed to facilitate access to our local resources," says Villalba. "Cloud Connexa was really easy and fast to set up, two things we really needed in that moment."Read more here. All links and the video of this episode can be found on CISO Series.com

New Redis worm, more ColdFusion confusion, Este Lauder breached

New P2PInfect worm targeting Redis servers on Linux and Windows systems Adobe releases new patches for exploited ColdFusion vulnerabilities Este Lauder breached by two ransomware groups And now a word from our sponsor, OpenVPN According to Oriel Hernan Villalba Pinzetta, a System Administrator with CEDEC's cybersecurity and IT department, "The pandemic meant we could not come to the office, and we needed to facilitate access to our local resources," says Villalba. "Cloud Connexa was really easy and fast to set up, two things we really needed in that moment." Read more at the link in our show notes. For the...

A rise in complex DDoS attacks, Mi6 warns of data traps, Microsoft expands log access

Complex DDoS attacks on the rise MI6 warns of Chinese data traps Microsoft expands cloud log access And now a word from our sponsor, OpenVPN Karim Hakim, CTO at Hakim Misr Paco, says that CloudConnexa has given him some long-sought peace of mind. "OpenVPN has helped my company to access remote nodes securely without worrying about security protocols," he says. "My company has been looking for a similar solution for years, and we finally got what we were looking for." Read more at the link in our show notes.

US launches IoT security labeling program, Renewable tech could pose electric grid risk, US blacklists two more spyware firms

US government launches IoT security labeling program Renewable technologies could pose risk to US electric grid US blacklists two spyware firms run by Israeli former general And now a word from our sponsor, OpenVPN Stephen Haecker, Chief Technology Officer at Carteras Colectivas, relies on Cloud Connexa customer support for his remote team. "I have used them about once per month to help with our growing networks," he says, "and the service quality is great with quick turnarounds." Haecker appreciates the consistency of the support team, and their personalized approach. Read more at the link in our show notes. For the...

JumpCloud Breach, LockBit attacks Wisconsin, Typos leak military emails

JumpCloud breached by APT Wisconsin allegedly hit by LockBit Typos leaking military emails And now a word from our sponsor, OpenVPN Zach Belhadri, the Infrastructure Manager at Knight Capital, shares why using Cloud Connexa for his team's security has been a game changer. With the Cybershield feature, he's able to prevent malware, phishing, and other threats by restricting access to only authorized and trusted internet destinations. He calls Cloud Connexa "an awesome product with huge potential." Read more at the link in our show notes.

Fast-acting Gamaredon, WormGPT improves phishing, Microsoft email mystery

Russia-linked Gamaredon starts stealing data 30 to 50 minutes after initial compromise New AI tool WormGPT allows for sophisticated cyber attacks Microsoft still unsure how hackers stole Azure AD signing key And now a word from our sponsor, OpenVPN We asked Anthony Hook, the CTO at Dataweavers, if he would recommend Cloud Connexa to other companies. His response? A resounding yes! With Cloud Connexa, he says "we bypassed the clunky client-owned VPNs and networks, gaining a seamless, secure, and efficient connectivity solution." Read more at the link in our show notes. For the stories behind the headlines, head to CISOseries.com.

Week in Review: Threat actors access government email, USB drive attacks spiking, cloud environment breaches

Link to Blog Post This week'sCyber Security Headlines Week in Review, July 10-14, is hosted bySean Kellywith our guest,Yaron Levi, CISO,Dolby Thanks to our show sponsor, Opal Opal is the data-centric identity platform. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower enterprises to understand and calibrate access end to end. The best security teams from companies like Databricks, Figma, Blend, and Drata use Opal to build identity security for scale. VisitOpal.dev. All links and the video of this episode can be found on CISO Series.com

USB malware spikes, Honeywell, Rockwell vulnerabilities, ransomware remains profitable

USB drive malware attacks spiking again in first half of 2023 Users of Honeywell Experion DCS platforms urged to patch 9 vulnerabilities immediately Ransomware gangs have extorted $449 million this year Thanks to this week's episode sponsor, Opal Opal is the data-centric identity platform. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower enterprises to understand and calibrate access end to end. The best security teams from companies like Databricks, Figma, Blend, and Drata use Opal to build identity security for scale. For the stories behind the headlines, head to...

NATO cyber pledges, tax prep data shared, a decrease in crypto crime

What we know about NATO cyber pledges Tax prep companies "recklessly" shared data Report finds decrease in crypto crime Thanks to this week's episode sponsor, Opal Opal is the data-centric identity platform. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower enterprises to understand and calibrate access end to end. The best security teams from companies like Databricks, Figma, Blend, and Drata use Opal to build identity security for scale.

Silk Road advisor sentenced, HCA Health data breach, Google hit with AI tool training lawsuit

Silk Road's senior advisor sentenced to 20 years in prison 11 million HCA patients impacted by data breach Google hit with lawsuit alleging it stole user data to train its AI tools Thanks to this week's episode sponsor, Opal Opal is the data-centric identity platform. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower enterprises to understand and calibrate access end to end. The best security teams from companies like Databricks, Figma, Blend, and Drata use Opal to build identity security for scale. For the stories behind the headlines, visit...

JumpCloud resets API keys, Genesis Market for sale, an EU-US data transfer agreement

JumpCloud resets customer API keys Would you be interested in a slightly used dark web market? US and EU agree on new data transfer agreement Thanks to this week's episode sponsor, Opal Opal is the data-centric identity platform. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower enterprises to understand and calibrate access end to end. The best security teams from companies like Databricks, Figma, Blend, and Drata use Opal to build identity security for scale.

BigHead Windows ransomware, RedEnergy targets utilities. more MOVEIt problems

New 'Big Head' ransomware displays fake Windows update alert RedEnergy stealer-as-a-ransomware threat targeting energy and telecom sectors Three new MOVEit bugs spur CISA warning as more victims report breaches Thanks to this week's episode sponsor, Opal Opal is the data-centric identity platform. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower enterprises to understand and calibrate access end to end. The best security teams from companies like Databricks, Figma, Blend, and Drata use Opal to build identity security for scale. For the stories behind the headlines, head to CISOseries.com.

Week in Review: TSMC supplier attacked, cardiac device warning, hospital ransomware increasing

Link to Blog Post This week'sCyber Security Headlines Week in Review, July 3-7, is hosted byRich Stroffolinowith our guest,Hadas Cassorla, CISO,M1 Thanks to today's episode sponsor, SlashNext SlashNext, a leader in SaaS-based Integrated Cloud Messaging Security across email, web, and mobile has the industry's first artificial intelligence solution, HumanAI, that uses generative AI to defend against advanced business email compromise (BEC), supply chain attacks, executive impersonation, and financial fraud. Request a demo today. All links and the video of this episode can be found on CISO Series.com

Shell MOVEit breach, Pepsi bottler breach, INTERPOL nabs OPERA1ER

Shell confirms MOVEit-related breach after ransomware group leaks data 28,000 impacted by data breach at Pepsi Bottling Ventures INTERPOL nabs hacking crew OPERA1ER's leader behind $11 million cybercrime Thanks to today's episode sponsor, SlashNext SlashNext, a leader in SaaS-based Integrated Cloud Messaging Security across email, web, and mobile has the industry's first artificial intelligence solution, HumanAI, that uses generative AI to defend against advanced business email compromise (BEC), supply chain attacks, executive impersonation, and financial fraud. Request a demo today. For the stories behind the headlines, head to CISOseries.com.

Japanese port hit with ransomware, EU court orders Meta data changes, White House can't contact social companies

Japan's major port hit with ransomware European court orders changes to Meta's data practices Injunction restricts White House contact with social media companies Thanks to today's episode sponsor, SlashNext SlashNext, a leader in SaaS-based Integrated Cloud Messaging Security across email, web, and mobile has the industry's first artificial intelligence solution, HumanAI, that uses generative AI to defend against advanced business email compromise (BEC), supply chain attacks, executive impersonation, and financial fraud. Request a demo today.

BlackCat pushes CobaltStrike, cardiac device warning, unpatched Fortigate firewalls

BlackCat ransomware pushes Cobalt Strike via WinSCP search ads CISA issues warning for cardiac device system vulnerability 330,000 FortiGate firewalls still unpatched to CVE-2023-27997 RCE flaw Thanks to today's episode sponsor, SlashNext SlashNext, a leader in SaaS-based Integrated Cloud Messaging Security across email, web, and mobile has the industry's first artificial intelligence solution, HumanAI, that uses generative AI to defend against advanced business email compromise (BEC), supply chain attacks, executive impersonation, and financial fraud. Request a demo today. For the stories behind the headlines, head to CISOseries.com.

Semiconductor giant attacked, State websites hacked, Russian Telecom infiltrated

Semiconductor giant says IT supplier was attacked, LockBit makes related claims Several US states investigating 'SiegedSec' hacking campaign Russian telecom confirms hack after group backing Wagner boasted about an attack Thanks to today's episode sponsor, SlashNext For the stories behind the headlines, head to CISOseries.com.

Week in Review: SolarWinds CISO blamed, Military smartwatch mystery, submarine cable risk

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 26-30, is hosted byRich Stroffolinowith our guest,Cassio Goldschmidt, CISO,ServiceTitan Thanks to our show sponsor, AppOmni Over provisioned users could expose your organization's most sensitive data. Just a single attack on one of those users may compromise your entire SaaS estate.With AppOmni's identity and threat detection capabilities, you can detect and respond to suspicious activities within your SaaS environment. Gain visibility into over provisioned users, the SaaS data they have access to, and receive guided remediation. Get started atAppOmni.com. All links and the video of this episode can be...

SolarWinds CISOs blamed, ThirdEye Windows malware, Government extends canary

SEC notice to SolarWinds CISO and CFO roils cybersecurity industry Newly uncovered ThirdEye Windows-based malware steals sensitive data Cyber Command to expand 'canary in the coal mine' unit working with private sector Thanks to today's episode sponsor, AppOmni Over provisioned users could expose your organization's most sensitive data. Just a single attack on one of those users may compromise your entire SaaS estate. With AppOmni's identity and threat detection capabilities, you can detect and respond to suspicious activities within your SaaS environment. Gain visibility into over provisioned users, the SaaS data they have access to, and receive guided remediation. Get...

Federal networks fail CISA rules, US AI chip bans, MOVEit victims grow

Federal network devices fail CISA requirements US considering more AI chip export bans The scope of MOVEit vulnerability Thanks to today's episode sponsor, AppOmni Are you continuously monitoring the common misconfigurations occurring in your SaaS ecosystem? From inactive connected SaaS apps retaining access to sensitive data, to threat actors manipulating conditional access rules, these misconfigurations can pose a significant threat to your SaaS security. Take action with AppOmni. Secure your organization's most sensitive data and continuously monitor your SaaS estate for data exposure and misconfigurations. Visit AppOmni.com to get a free risk assessment.

Over 6,500 arrested since EncroChat hack, Third-party vendor hack exposes American and Southwest data, Microsoft service outage woes continue

Thanks to today's episode sponsor, AppOmni Over provisioned users could expose your organization's most sensitive data. Just a single attack on one of those users may compromise your entire SaaS estate. With AppOmni's identity and threat detection capabilities, you can detect and respond to suspicious activities within your SaaS environment. Gain visibility into over provisioned users, the SaaS data they have access to, and receive guided remediation. Get started at AppOmni.com. For the stories behind the headlines, visit CISOseries.com.

Monopoly darknet charges, Activision Blizzard DDoS, 5G aircraft deadline

Monopoly darknet operator charged Activision Blizzard games hit with DDoS 5G deadline could impact flights Thanks to today's episode sponsor, AppOmni Are you continuously monitoring the common misconfigurations occurring in your SaaS ecosystem? From inactive connected SaaS apps retaining access to sensitive data, to threat actors manipulating conditional access rules, these misconfigurations can pose a significant threat to your SaaS security. Take action with AppOmni. Secure your organization's most sensitive data and continuously monitor your SaaS estate for data exposure and misconfigurations. Visit AppOmni.com to get a free risk assessment.

CISA adds vulnerabilities, mysterious military smartwatches, more Office problems

CISA adds 6 flaws to known exploited vulnerabilities catalog US military personnel report receiving smartwatches in the mail Microsoft 365 users new Outlook and Teams problems Thanks to today's episode sponsor, AppOmni Over provisioned users could expose your organization's most sensitive data. Just a single attack on one of those users may compromise your entire SaaS estate. With AppOmni's identity and threat detection capabilities, you can detect and respond to suspicious activities within your SaaS environment. Gain visibility into over provisioned users, the SaaS data they have access to, and receive guided remediation. Get started at AppOmni.com. For the stories...

Week in Review: Microsoft confirms cyberattack, more MOVEit damage, reddit hit with ransomware

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 19-23, is hosted byRich Stroffolinowith our guest,Janet Heins, CISO,iHeartMedia Thanks to our show sponsor, Wing Security The first step to securing your organization's SaaS usage is knowing which SaaS applications your employees are using. 3rd party included. Wing offers a completely free, SaaS Shadow IT Discovery tool. You can find it atwing.securityand self onboard. No sales in the process, no credit card needed, no time-limit. Just go ahead and discover your SaaS usage. All links and the video of this episode can be found on CISO Series.com

Canadian breaches increase, new China backdoor, kinetic warfare threat

Cybersecurity breaches more than double among Canadian businesses Experienced China-based hacking group has new backdoor tool Cyberattacks on OT, ICS lay groundwork for kinetic warfare Thanks to today's episode sponsor, Wing Security The first step to securing your organization's SaaS usage is knowing which SaaS applications your employees are using. 3rd party included. Wing offers a completely free, SaaS Shadow IT Discovery tool. You can find it at wing.security and self onboard. No sales in the process, no credit card needed, no time-limit. Just go ahead and discover your SaaS usage. For the stories behind the headlines, head to CISOseries.com.

DoJ targets nation-state actors, Apple fixes Triangulation zero-day, Schumer unveils strategy to regulate AI

New DoJ cyber prosecution team will go after nation-state threat actors Apple fixes zero-days used to deploy Triangulation spyware Schumer unveils strategy to regulate AI Thanks to today's episode sponsor, Wing Security Shadow IT is an evolving pain and a security risk, especially in today's decentralized work environments. Now's the time to regain control of your SaaS usage by taking advantage of Wing's Free SaaS Shadow IT discovery solution. Check out wing.security to self-onboard today, no strings attached. For the stories behind the headlines, visit CISOseries.com.

Rorschach ransomware, Australian government data leak, security market outpaces tech

Rorschach ransomware takes the speed crown Data leak impacts Australian government Cyber security market growth outpaces tech sector Thanks to today's episode sponsor, Wing Security Can you answer these three questions confidently? 1. How many SaaS applications are used in your organization? 2. Which permissions did users provide these applications? and 3. What is the data that flows in and in between these applications? Wing provides the answers. In fact, it discovers your SaaS usage completely for free, no time limit. Visit wing.security to self-onboard.

Reddit's ransom, UK shuffles cyber chief, Binance reaches SEC deal

Reddit hit with ransom demand UK's cyber chief moves on to organized crime Binance reaches deal with the SEC Thanks to today's episode sponsor, Wing Security The first step to securing your organization's SaaS usage is knowing which SaaS applications your employees are using. 3rd party included. Wing offers a completely free, SaaS Shadow IT Discovery tool. You can find it at wing.security and self onboard. No sales in the process, no credit card needed, no time-limit. It takes minutes to discover your organization's SaaS usage.

Microsoft's June cyberattacks, third MOVEit vulnerability, US Clop bounty

Microsoft says early June service outages were cyberattacks Third MOVEit vulnerability raises alarms as US Agriculture Department says it may be impacted US govt offers $10 million bounty for info on Clop ransomware Thanks to today's episode sponsor, Wing Security The folks at Wing believe that SaaS Shadow IT discovery is the basic first step to securing your SaaS usage. They believe it so strongly that they launched a completely free SaaS Shadow IT Discovery solution. Check out wing.security to self-onboard today, no strings attached, no time limit. Wing.security. For the stories behind the headlines, head to CISOseries.com.

Week in Review: Microsoft banking warning, undetectable BatCloak malware, more MOVEit vulnerabilities

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 12-16, is hosted bySean Kellywith our guest,Phil Beyer, former Head of Security, Etsy Thanks to our show sponsor, Conveyor Your scariest questionnaires that are hundreds of questions long are no match for Conveyor's GPT-questionnaire tool now with a browser extension for complex portals. Get GPT-generated precise answers to entire questionnaires so your review takes seconds. Now you can spend 89% less time completing questionnaires when you get accurate answers you don't have to re-write. Try a free proof of concept with your own data to see it in...

US federal agencies affected by MOVEit breach, Pentagon leak suspect indicted, Suspected LockBit ransomware affiliate nabbed

US federal agencies affected by MOVEit vulnerability Pentagon leak suspect indicted by a federal grand jury Suspected LockBit ransomware affiliate nabbed Thanks to today's episode sponsor, Conveyor Your scariest questionnaires that are hundreds of questions long are no match for Conveyor's GPT-questionnaire tool - now with a browser extension for complex portals. Get GPT-generated precise answers to entire questionnaires so your review takes seconds. Now you can spend 89% less time completing questionnaires when you get accurate answers you don't have to re-write. Try a free proof of concept with your own data to see it in action. See what...

China ESXi exploit, WooCommerce vulnerability, Lockbit ransom report

China-linked APT group spotted exploiting a VMware ESXi zero-day Hundreds of thousands of ecommerce sites impacted by critical plugin vulnerability 7-Nation LockBit report shows US paid over $90m in ransoms since 2020 Thanks to today's episode sponsor, Conveyor Let's gladly pass the most thankless job in cybersecurity completing customer security questionnaires to the AI bots. Conveyor's GPT-questionnaire response tool auto-generates precise, accurate answers to entire questionnaires. With accuracy far superior to other tools, you can spend almost zero time reviewing generated answers. There's an in platform auto-fill feature or a browser extension for tricky portals. Stop settling for mediocre tools...

Amazon server outage, Fortinet zero-day exploited, US intelligence buys personal data

Amazon server outage broke fast food apps among other things Update: Fortinet warns of possible zero-day exploited in limited attacks US intelligence confirms it buys Americans' personal data Thanks to today's episode sponsor, Conveyor What's better than using Conveyor's GPT-questionnaire response tool to generate precise answers to security questionnaires? Letting customers upload their own questionnaires to your portal and getting back answers in seconds - all based on the content in your knowledge base. Think of it like a security questionnaire ATM. A prospect clicks through an NDA, uploads questions and gets all the answers they need from the bot,...

Fortigate firewall flaw, BatCloak's undetectable malware, Swiss government cyberattacks

Critical RCE flaw discovered in Fortinet FortiGate firewalls BatCloak engine makes malware fully undetectable Swiss Government targeted by series of cyberattacks Thanks to today's episode sponsor, Conveyor Tried to use GPT to fill out questionnaires yet? We already built that for you. Conveyor's GPT-questionnaire response tool auto-generates precise, accurate answers to entire questionnaires. With accuracy far superior to other tools, you can spend almost zero time reviewing generated answers. There's also a browser extension for complex portals and other scary questionnaires. Best part is, it actually works. Try a free proof of concept with your own data to see it...

Faked journalist hack, Strava leaks locations, Reddit API protests

Faked crypto journalists steal real crypto Strava heat maps leak addresses API changes lead to Reddit protests Thanks to today's episode sponsor, Conveyor Let's gladly pass the most thankless job in cybersecurity completing customer security questionnaires to the AI bots. Conveyor's GPT-questionnaire response tool auto-generates precise, accurate answers to entire questionnaires. With accuracy far superior to other tools, you can spend almost zero time reviewing generated answers. There's an in platform auto-fill feature or a browser extension for tricky portals. Stop settling for mediocre tools that only provide lousy "near hits" from your library. Try a free proof of concept...

Week in Review: Hipponen's malware warning, outwitting hackers, Clop's MoveIt attack

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 5-9, is hosted byRich Stroffolinowith our guest,Joshua Scott, Head of Security and IT,Postman Thanks to our show sponsor, Trend Micro Hybrid work, cloud adoption, and shadow IT have introduced new cybersecurity risks to organizations. Security leaders are left asking, "How can I manage our expanding attack surface?" Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities in their "Risk to Resilience World Tour. Hear from experts on the latest threat landscape trends, solutions, and platform strategies to manage risk...

PowerDrop targets Defense, YKK zipper attacked, Barracuda urges replacement

New PowerDrop malware targets U.S. aerospace defense industry Zipper giant YKK confirms cyberattack targeted U.S. networks Barracuda urges customers to replace vulnerable appliances immediately Thanks to this week's episode sponsor, Trend Micro Hybrid work, cloud adoption, and shadow IT have introduced new cybersecurity risks to organizations. Security leaders are left asking, "How can I manage our expanding attack surface?" Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities in their "Risk to Resilience World Tour. Hear from experts on the latest threat landscape trends, solutions, and platform strategies to manage risk...

Google email authentication, SEC data breaches, Clop asks victims to email

Google improves brand email authentication SEC drops cases due to data protection failures Clop asks victims to contact it for a ransom Thanks to this week's episode sponsor, Trend Micro Hybrid work, cloud adoption, and shadow IT have introduced new cybersecurity risks to organizations. Security leaders are left asking, "How can I manage our expanding attack surface?" Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities in their "Risk to Resilience World Tour. Hear from experts on the latest threat landscape trends, solutions, and platform strategies to manage risk and defend...

Microsoft $20M COPPA settlement, Hactivists take credit for Outlook.com outages, SEC accuses Coinbase of breaking US regulations

Thanks to this week's episode sponsor, Trend Micro Hybrid work, cloud adoption, and shadow IT have introduced new cybersecurity risks to organizations. Security leaders are left asking, "How can I manage our expanding attack surface?" Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities in their "Risk to Resilience World Tour. Hear from experts on the latest threat landscape trends, solutions, and platform strategies to manage risk and defend your organization with speed and accuracy. Find the closest city to you and register today to take a leap towards a more...

Satellite hacking, Atomic Wallet breach, SEC sues Binance

Satellite hacking at DEF CON Atomic Wallet investigating losses SEC sues Binance Thanks to this week's episode sponsor, Trend Micro Hybrid work, cloud adoption, and shadow IT have introduced new cybersecurity risks to organizations. Security leaders are left asking, "How can I manage our expanding attack surface?" Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities in their "Risk to Resilience World Tour. Hear from experts on the latest threat landscape trends, solutions, and platform strategies to manage risk and defend your organization with speed and accuracy. Find the closest city...

Switzerland Xplain attack, BlackSuit resembles Royal, Microsoft retires Cortana

Xplain hack impacts Swiss cantonal police and Fedpol BlackSuit shows similarities to Royal Microsoft is retiring Cortana on Windows Thanks to this week's episode sponsor, Trend Micro Hybrid work, cloud adoption, and shadow IT have introduced new cybersecurity risks to organizations. Security leaders are left asking, "How can I manage our expanding attack surface?" Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities in their "Risk to Resilience World Tour. Hear from experts on the latest threat landscape trends, solutions, and platform strategies to manage risk and defend your organization with...

Week in Review: Amazon Ring privacy violations, Gigabyte firmware problems, AI extinction threat

Link to Blog Post This week's Cyber Security Headlines - Week in Review, May 29-June 2, is hosted by Sean Kelly with our guest, Howard Holton, CTO, GigaOm Thanks to today's episode sponsor, Barricade Cyber Have you fallen victim to a ransomware attack? Don't worry! Barricade Cyber Solutions has helped thousands of customers in situations just like yours. Their proprietary ransomware recovery services are designed to quickly get your business back on track. Their team of experts will identify the source of the attack and provide a comprehensive solution to prevent it from happening again. You can count on them...

Amazon Ring privacy violations, Kaspersky triangulation APT, CyberCommand Hartman

Amazon Ring, Alexa accused of privacy violations by FTC Kaspersky reports on new mobile APT campaign targeting iOS devices White House to choose Army general Hartman to be Cyber Command No. 2 Thanks to today's episode sponsor, Barricade Cyber Solutions Have you fallen victim to a ransomware attack? Don't worry! Barricade Cyber Solutions has helped thousands of customers in situations just like yours. Their proprietary ransomware recovery services are designed to quickly get your business back on track. Their team of experts will identify the source of the attack and provide a comprehensive solution to prevent it from happening again....

More Toyota leaks, Gigabyte firmware issues, Twitter Community Notes for images

Toyota finds more cloud leaks Gigabyte firmware update system insecure Twitter expands Community Notes to images Thanks to today's episode sponsor, Barricade Cyber Solutions Have you fallen victim to a ransomware attack? Don't worry! Barricade Cyber Solutions has helped thousands of customers in situations just like yours. Their proprietary ransomware recovery services are designed to quickly get your business back on track. Their team of experts will identify the source of the attack and provide a comprehensive solution to prevent it from happening again. You can count on them for the security of your data and systems. Visit barricadecyber.com

Experts warn of extinction from AI, Hackers demand $3 million from Scandinavian Airlines, Theranos founder surrenders to 11-year prison term

Leading experts warn of a risk of extinction from AI Hackers demand $3 million from Scandinavian Airlines Theranos founder turns herself in for 11-year prison term Thanks to today's episode sponsor, Barricade Cyber Solutions Have you fallen victim to a ransomware attack? Don't worry! Barricade Cyber Solutions has helped thousands of customers in situations just like yours. Their proprietary ransomware recovery services are designed to quickly get your business back on track. Their team of experts will identify the source of the attack and provide a comprehensive solution to prevent it from happening again. You can count on them for...

GobRAT targets Linux, RPMSG messages exploited, Augusta Georgia cyberattack

New GobRAT remote access trojan targeting Linux routers in Japan Attackers use encrypted RPMSG messages in Microsoft 365 targeted phishing attacks Hackers hold city of Augusta hostage in a ransomware attack Thanks to today's episode sponsor, Barricade Cyber Solutions Have you fallen victim to a ransomware attack? Don't worry! Barricade Cyber Solutions has helped thousands of customers in situations just like yours. Their proprietary ransomware recovery services are designed to quickly get your business back on track. Their team of experts will identify the source of the attack and provide a comprehensive solution to prevent it from happening again. You...

Week in Review: Industrial infrastructure threat, BEC attempts on the rise, TikTok's Texas progress

Link to Blog Post Cyber Security Headlines Week in Review, May 22-26, is hosted byRich Stroffolinowith our guest,Rich Greenberg,ISSADistinguished Fellow and Honor Roll Thanks to our show sponsor, Sonrai Security Did you know that 81% of breaches are due to compromised identities? It's a sobering statistic and one that enterprise organizations cannot afford to ignore. Sonrai Security has made a name for itself by securing enterprise clouds from the inside out, securing every identity, access, and permission in the cloud. Download Sonrai Security's new CIEM Buyer's Guide to learn more about fortifying your cloud from the inside out atsonraisecurity.com. All...

GDPR turns 5, GitLab patches vulnerability, Russian industrial malware

GDPR is 5 years old, and over 1 million people have asked to be forgotten GitLab security update patches critical vulnerability Mysterious malware designed to cripple industrial systems linked to Russia And now a word from our sponsor, Sonrai Security Did you know that 81% of breaches are due to compromised identities? It's a sobering statistic and one that enterprise organizations cannot afford to ignore. Sonrai Security has made a name for itself by securing enterprise clouds from the inside out, securing every identity, access, and permission in the cloud. DownloadSonrai Security's new CIEM Buyer's Guide to learn more about...

Google launches GUAC, Barracuda zero-day, campaign targets Kenyan debt

Google launches GUAC Barracuda gateways breached by zero-day Cyberattacks focus on Kenya's Chinese debt And now a word from our sponsor, Sonrai Security Did you know that 81% of breaches are due to compromised identities? It's a sobering statistic and one that enterprise organizations cannot afford to ignore. Sonrai Security has made a name for itself by securing enterprise clouds from the inside out, securing every identity, access, and permission in the cloud. DownloadSonrai Security's new CIEM Buyer's Guide to learn more about fortifying your cloud from the inside out at sonraisecurity.com.

TikTok sues Montana, US sanctions orgs behind North Korea's 'illicit' IT worker army, Fake Twitter images spook stock market

TikTok sues Montana after state bans app US sanctions orgs behind North Korea's 'illicit' IT worker army Fake images on Twitter briefly spook the stock market And now a word from our sponsor, Sonrai Security Did you know that 81% of breaches are due to compromised identities? It's a sobering statistic and one that enterprise organizations cannot afford to ignore. Sonrai Security has made a name for itself by securing enterprise clouds from the inside out, securing every identity, access, and permission in the cloud. DownloadSonrai Security's new CIEM Buyer's Guide to learn more about fortifying your cloud from the...

Meta's Record EU fine, China bans Micron, Tornado Cash hacked

Meta receives record fine over EU data transfers China bans Micron over cybersecurity risks Crypto mixer hijacked And now a word from our sponsor, Sonrai Security Did you know that 81% of breaches are due to compromised identities? It's a sobering statistic and one that enterprise organizations cannot afford to ignore. Sonrai Security has made a name for itself by securing enterprise clouds from the inside out, securing every identity, access, and permission in the cloud. DownloadSonrai Security's new CIEM Buyer's Guide to learn more about fortifying your cloud from the inside out at sonraisecurity.com.

HP's bricked printers, PyPi repository attack, Samsung security flaw

HP rushes to fix bricked printers after faulty firmware update PyPI repository under attack: User sign-ups and package uploads temporarily halted New security flaw exposed in Samsung devices And now a word from our sponsor, Sonrai Security Did you know that 81% of breaches are due to compromised identities? It's a sobering statistic and one that enterprise organizations cannot afford to ignore. Sonrai Security has made a name for itself by securing enterprise clouds from the inside out, securing every identity, access, and permission in the cloud. DownloadSonrai Security's new CIEM Buyer's Guide to learn more about fortifying your cloud...

Week in Review: Supreme Court's 230 ruling, Tech giants hit, TLD phishing vectors

Link to Blog Post This week'sCyber Security Headlines Week in Review, May 15-19, is hosted byRich Stroffolinowith our guest,Dave Hannigan, CISO,Nubank Thanks to our show sponsor, Hunters There is nothing worse than relying on a legacy SIEM that your security team has out-grown, especially when it impacts your ability to detect real incidents. Hunters' SOC Platform offers built-in, always up-to-date detection rules and automatic correlation that allow SOC analysts to focus on higher-value tasks that impact your organization. It's time to move to a platform that reduces risk, complexity and cost for the SOC. Visithunters.securityto learn how you can Move...

Supreme Court's 230 ruling, Montana bans TikTok, Guerilla smartphone malware

Supreme Court shields Twitter from liability and leaves Section 230 untouched Montana governor bans TikTok Millions of smartphones distributed worldwide with preinstalled 'Guerrilla' malware Thanks to today's episode sponsor, Hunters There is nothing worse than relying on a legacy SIEM that your security team has out-grown, especially when it impacts your ability to detect real incidents. Hunters' SOC Platform offers built-in, always up-to-date detection rules and automatic correlation that allow SOC analysts to focus on higher-value tasks that impact your organization. It's time to move to a platform that reduces risk, complexity & cost for the SOC. Visit hunters.security to...

Lancefly in Asia, Meta EU fine, TLD phishing

Lancefly group hits Asia Meta facing record EU privacy fine New TLDs a vector for phishing Thanks to today's episode sponsor, Hunters There is nothing worse than relying on a legacy SIEM that your security team has out-grown, especially when it impacts your ability to detect real incidents. Hunters' SOC Platform offers built-in, always up-to-date detection rules and automatic correlation that allow SOC analysts to focus on higher-value tasks that impact your organization. It's time to move to a platform that reduces risk, complexity & cost for the SOC. Visit hunters.security to learn how you can Move Beyond SIEM and...

Inside RaaS, cyber education initiatives, attacking TP-Link routers

An inside look at RaaS White House cyber strategy goes big on education Chinese attackers hit TP-Link routers Thanks to today's episode sponsor, Hunters If your SIEM is causing an endless cycle of noisy alerts, manually writing generic detection rules, and limited data ingestion & retention, your SOC might need an upgrade. Hunters is a SaaS platform, purpose built for your Security Operations team. Solaris Group, a leading German FinTech, implemented Hunters SOC Platform to eliminate the burden of redundant detection engineering and manual event correlation allowing SOC analysts to focus on higher-value tasks. Visit hunters.security to learn how your...

Philadelphia Inquirer cyber attack, DOT breach exposes federal employee data, 3 million data breach notices sent to SchoolDude users

Cyber attack hits Philadelphia Inquirer Transportation Department cyber breach exposes federal employee data 3 million data breach notices being sent to SchoolDude users Thanks to today's episode sponsor, Hunters Relying on a SIEM in 2023 is like living in a college dorm room, post-graduation - you're operating in an environment you've out-grown. The Hunters SOC Platform is purpose built to help your Security Operations mature to the level you need to be at. ChargePoint, the world's largest network of electric vehicle charging stations, uses Hunters SOC Platform to leverage its out-of-the-box detection content to more efficiently respond to new threats...

Discord suffers data breach, Toyota data exposed, ABB confirms incident

Discord suffers data breach Car location data of 2 million Toyota customers exposed for ten years Swiss tech giant ABB confirms 'IT security incident' Thanks to today's episode sponsor, Hunters Hunters is a SOC platform, built for your security team. Hunters empowers companies to move beyond SIEM with unlimited ingestion and normalization of security data at a predictable cost. Using Hunters, a CISO at a leading online retailer "tripled the amount of data ingested by her security team while cutting costs from a legacy SIEM provider by 75%." It's time to Move Beyond SIEM. Visit hunters.security to learn more and...

Week in Review: Easterly AI warning, Windows admin alerts, Dallas ransomware fallout

Link to Blog Post Cyber Security Headlines Week in Review, May 8-12, is hosted byRich Stroffolinowith our guest, Paul Connelly, Former CISO, HCA Healthcare Thanks to today's episode sponsor, Trend Micro Cybersecurity is not just about protection, it's about foresight, agility, and resilience.Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks.Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to Resilience World Tour" The...

Twitter encrypts messages, Microsoft's Outlook patch, Seoul hospital breached

Twitter launches encrypted private messages Microsoft releases fix for patched Outlook issue exploited by Russian hackers North Korea-linked APT group breaches the Seoul National University Hospital Thanks to today's episode sponsor, TrendMicro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks. Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to Resilience...

Leaked Intel keys, trading security for fps, new phishing-as-a-service tool

The long term impact of leaked Intel Boot Guard keys AtlasOS shrugs at Windows security features Cisco warns of new phishing-as-a-service tool Thanks to today's episode sponsor, TrendMicro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks. Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to Resilience World Tour" The largest...

'Snake' malware network takedown, 'PlugwalkJoe' behind massive 2020 Twitter hack, Justice Department takes down 13 DDoS-for-Hire sites

Operation Medusa takes down 'Snake' malware network 'PlugwalkJoe' pleads guilty to massive 2020 Twitter hack Justice Department takes down 13 DDoS-for-Hire sites Thanks to today's episode sponsor, TrendMicro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks. Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to Resilience World Tour" The largest...

Dallas ransomware, spoofed Facebooks ads, Merck insurance ruling

Dallas still reeling from ransomware Hacked Facebook pages buying Facebook ads Court rules on Merck cyber insurance claim Thanks to today's episode sponsor, TrendMicro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks. Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to Resilience World Tour" The largest cybersecurity roadshow of its...

Easterly's AI warning, Ex-Uber Sullivan sentenced, Play's Massachusetts ransomware

Top US cyber official warns AI may be the 'most powerful weapon of our time' Ex-Uber CSO given three-year probation sentence, avoids prison after guilty verdict Ransomware group behind Oakland attack targets city in Massachusetts Thanks to today's episode sponsor, TrendMicro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks. Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities...

Week in Review: Ex-Uber Sullivan's sentence, SolarWinds detected earlier, AI godfather quits

Link to Blog Post This week'sCyber Security Headlines Week in Review, May 1-5, is hosted byRich Stroffolinowith our guest,Allison Miller, Cybersecurity and Technology Executive Thanks to our show sponsor, Trend Micro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks. Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to Resilience World...

Royal ransoms Dallas, new PaperCut exploit, CISA's Mirai warning

City of Dallas hit by Royal ransomware attack impacting IT services Researchers uncover new exploit for PaperCut vulnerability that can bypass detection Mirai botnet loves exploiting unpatched TP-Link routers, CISA warns Thanks to today's episode sponsor, TrendMicro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks.Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their...

Meta FTC troubles, CISA urges Covered List, malicious HTML attachments

FTC comes down on Meta monetizing minors CISA urges adoption of Covered List Almost half of HTML attachments found malicious Thanks to today's episode sponsor, TrendMicro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks.Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to Resilience World Tour" The largest cybersecurity roadshow of...

Authorities seize 9 crypto exchanges, T-Mobile discloses 2nd data breach of 2023, 'Godfather of AI' quits Google

Authorities seize 9 crypto exchanges used for money laundering T-Mobile discloses 2nd data breach of 2023 'Godfather of AI' quits Google and warns of misinformation dangers Thanks to today's episode sponsor, TrendMicro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks.Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to Resilience World...

Juice jacking, data breach lawsuits, Telegram ban lifted

The academic threat of juice jacking Data breach lawsuits on the rise Telegram ban lifted in Brazil Thanks to today's episode sponsor, TrendMicro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks.Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to Resilience World Tour" The largest cybersecurity roadshow of its kind. Find...

Veeam backup targeted, DOJ SolarWinds discovery, Americold frozen out

Hackers target vulnerable Veeam backup servers exposed online DOJ detected the SolarWinds hack 6 months earlier than first disclosed Cold storage giant Americold outage caused by network breach Thanks to today's episode sponsor, TrendMicro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks.Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to...

Week in Review: Energy sector 3CX attack, PaperCut pain continues, all-in-one infostealer

Link to Blog Post This week'sCyber Security Headlines Week in Review, April 24-28, is hosted bySean Kellywith our guest,Steve Zalewski, former CISO, Levi Strauss and co-host, Defense in Depth. Thanks to today's episode sponsor, Tines Ready to take security automation up a notch? With Tines, it's easier than ever! The no-code automation platform is redefining and simplifying security operations start building mission-critical workflows and apps that streamline processes AND ensure crucial data stays safe while extending the influence of your security team throughout your organization. VisitTines.comto find out more! All links and the video of this episode can be found...

New BellaCiao malware, PaperCut is Clop, Europe tech crackdown

Charming Kitten APT uses a new BellaCiao malware Microsoft blames clop affiliate for PaperCut attacks Big tech crackdown looms as EU, UK ready new rules And now a word from our sponsor, Tines Ready to take security automation up a notch? With Tines, it's easier than ever! The no-code automation platform is redefining and simplifying security operations - start building mission-critical workflows and apps that streamline processes AND ensure crucial data stays safe while extending the influence of your security team throughout your organization. Visit Tines.com to find out more! For the stories behind the headlines, head to CISOseries.com.

Messaging malware update, China reclassifies cyberattacks, more cyberattacks don't use malware

Messaging app update distributes malware China reclassifies cyberattacks Malware-free cyberattacks on the rise And now a word from our sponsor, Tines Ask anyone at RSA; security teams can't operate in a silo. No SOAR solutions enable users to dynamically collect information outside their systems and use it at multiple points in an automated workflow - but Tines does! With Tines, users can exchange real-time information outside its platform and use it to drive automated workflows. Visit Tines.com/build to learn more!

US policing AI use for civil rights violations, Bill proposes security testing centers for government tech, Microsoft Edge leaking browsing data to Bing

US policing use of AI for civil rights violations Bill proposes new security testing centers for critical government tech Microsoft Edge is leaking user browsing data to Bing And now a word from our sponsor, Tines To proactively protect against threats, you need a culture of cybersecurity - and solutions that facilitate this. With Tines' no-code automation platform, you can: 1. Remediate threats faster. 2. Improve automation. 3. Control access to your data. 4. Create a culture of cybersecurity. Tines allows users to leverage real-time information across any stage of an automated workflow! Visit Tines.com to learn more. For the...

Threat group taxonomy, disabling EDR, North Dakota's AI cyber tools

A call to standardize threat group naming Threat actors using new tool to disable EDR North Dakota turns to AI for cyber And now a word from our sponsor, Tines Ready to take security automation up a notch? With Tines, it's easier than ever! The no-code automation platform is redefining and simplifying security operations - start building mission-critical workflows and apps that streamline processes AND ensure crucial data stays safe while extending the influence of your security team throughout your organization. Visit Tines.com to find out more.

3CX hits utilities, CISA PaperCut warning, Hyena devours GPT4

Energy sector orgs in US, Europe hit by same supply chain attack as 3CX CISA adds 3 actively exploited flaws to KEV catalog, including critical PaperCut bug Hyena code poised to devour GPT4 And now a word from our sponsor, Tines Ask anyone at RSA; security teams can't operate in a silo. No SOAR solutions enable users to dynamically collect information outside their systems and use it at multiple points in an automated workflow - but Tines does! With Tines, users can exchange real-time information outside its platform and use it to drive automated workflows. Visit Tines.com/build to learn more!...

"New class" of Russian attackers, GitHub helps open source security, used routers leak info

NCSC warns of "new class" of Russian adversaries GitHub adds Action to help open source security Used routers hold on to secrets Thanks to today's episode sponsor, Pentera This episode of Cyber Security Headlines is made possible in part by Pentera. Today over 60% of cyber attacks involve the use of exposed credentials. Now, for the first time, security teams can address this critical threat head-on. Pentera collects an organization's leaked credentials and automatically tests their exploitability across the external and internal attack surface. Pentera's customers find that leveraging the Pentera automated security validation platform as part of their exposure...

Week in Review: 3CX double supply chain attack, Remcos Tax-Day RAT, Surveillance kills morale

Link to Blog Post This week'sCyber Security Headlines Week in Review, April 17-21, is hosted byRich Stroffolinowith our guest, Shawn Bowen, CISO,World Fuel Services Thanks to our show sponsor, Pentera This episode of Cyber Security Headlines is made possible in part by Pentera. Today over 60% of cyber attacks involve the use of exposed credentials. Now, for the first time, security teams can address this critical threat head-on. Pentera collects an organization's leaked credentials and automatically tests their exploitability across the external and internal attack surface. Pentera's customers find that leveraging the Pentera automated security validation platform as part of...

Microsoft 365 outage, Capita burglary evidence, 3CX attack update

Microsoft 365 outage blocks access to web apps and services Capita has 'evidence' customer data was stolen in digital burglary 3CX supply chain attack was the result of a previous supply chain attack Thanks to today's episode sponsor, Pentera This episode of Cyber Security Headlines is made possible in part by Pentera. Today over 60% of cyber attacks involve the use of exposed credentials. Now, for the first time, security teams can address this critical threat head-on. Pentera collects an organization's leaked credentials and automatically tests their exploitability across the external and internal attack surface. Pentera's customers find that leveraging...

Elon Musk wants to develop TruthGPT, Southwest disrupted by 'technical issue', Officials warn of hackers targeting Cisco routers

Elon Musk wants to develop TruthGPT Southwest's operations resume after a 'technical issue' US, UK warn of govt hackers targeting Cisco routers Thanks to today's episode sponsor, Pentera This episode of Cyber Security Headlines is made possible in part by Pentera. Today over 60% of cyber attacks involve the use of exposed credentials. Now, for the first time, security teams can address this critical threat head-on. Pentera collects an organization's leaked credentials and automatically tests their exploitability across the external and internal attack surface. Pentera's customers find that leveraging the Pentera automated security validation platform as part of their exposure...

LockBit on macOS, low code security, and QuaDream shuts down

Ransomware comes for macOS The security considerations of low code Israeli offensive cyber company shutting down Thanks to today's episode sponsor, Pentera This episode of Cyber Security Headlines is made possible in part by Pentera. Today over 60% of cyber attacks involve the use of exposed credentials. Now, for the first time, security teams can address this critical threat head-on. Pentera collects an organization's leaked credentials and automatically tests their exploitability across the external and internal attack surface. Pentera's customers find that leveraging the Pentera automated security validation platform as part of their exposure management strategy increases their ability to...

Tax Day RAT warning, NCR POS outage, Urgent Chrome fix

Microsoft warns of Remcos RAT campaign targeting tax accountants NCR suffers POS outage after BlackCat ransomware attack Google releases urgent Chrome update to fix actively exploited zero-day vulnerability Thanks to today's episode sponsor, Pentera This episode of Cyber Security Headlines is made possible in part by Pentera. Today over 60% of cyber attacks involve the use of exposed credentials. Now, for the first time, security teams can address this critical threat head-on. Pentera collects an organization's leaked credentials and automatically tests their exploitability across the external and internal attack surface. Pentera's customers find that leveraging the Pentera automated security validation...

Week in Review: Pentagon papers leak, keeping breaches quiet, Cisco air-gaps Webex

Link to Blog Post This week'sCyber Security Headlines Week in Review, April 10-14, is hosted byRich Stroffolinowith our guest,Dmitriy Sokolovskiy, CISO,Avid Thanks to our show sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms, like Salesforce, Microsoft 365, or Google Workspace? What about the data these apps can access? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk.With AppOmni, you get visibility to all third party apps and SaaS-to-SaaS connections including which end users have enabled them, and the level of data access they've been granted. VisitAppOmni.comtoday...

Google Cloud's weak passwords, pressure on breach disclosure, Discord cooperating on Pentagon leak

Weak passwords targeted on Google Cloud Potential IT snitches warned about employment stitches Discord cooperating with leaked document investigation And now a word from our sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms, like Salseforce, Microsoft 365, or Google Workspace? What about the data these apps can access? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps and SaaS-to-SaaS connections including which end users have enabled them, and the level of data access they've been granted....

Windows Nokoyawa ransomware, LinkedIn pushes verification, Russia's Ukraine cyberwar

Windows zero-day exploited in Nokoyawa ransomware attacks LinkedIn and Microsoft Entra introduce a new way to verify professional contacts Russian places Ukraine internet infrastructure clearly in its sights, both high tech and low And now a word from our sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms, like Salseforce, Microsoft 365, or Google Workspace? What about the data these apps can access? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps and SaaS-to-SaaS connections including which...

Microsoft warns of Azure shared key abuse, Attackers hide stealer behind AI Facebook ads, OpenAI bug bounty program

Microsoft warns of Azure shared key authorization abuse Attackers hide stealer behind AI chatbot Facebook ads OpenAI to launch bug bounty program And now a word from our sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms, like Salseforce, Microsoft 365, or Google Workspace? What about the data these apps can access? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps and SaaS-to-SaaS connections including which end users have enabled them, and the level of data access...

Netherlands adopting RPKI, WordPress backdoor, tracing the Pentagon leak

Netherlands to adopt RPKI Widespread backdoor installed on WordPress sites Tracing leaked Pentagon documents And now a word from our sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms, like Salseforce, Microsoft 365, or Google Workspace? What about the data these apps can access? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps and SaaS-to-SaaS connections including which end users have enabled them, and the level of data access they've been granted. Visit AppOmni.com today to request...

Apple zero-day updates, Flipper Zero ban, China Micron probe

Apple releases updates to address zero-day flaws Flipper Zero banned by Amazon for being a 'card skimming device' China to probe Micron over cybersecurity, in chip war's latest battle And now a word from our sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms, like Salseforce, Microsoft 365, or Google Workspace? What about the data these apps can access? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps and SaaS-to-SaaS connections including which end users have enabled...

Week in Review: North Korea hacks 3CX, DISH ransomware lawsuits, Genesis Market seized

Link to Blog Post This week'sCyber Security Headlines Week in Review, April 3-7, is hosted byRich Stroffolino with our guest, Rich Gautier, former CISO, Department of Justice, Criminal Division Was your address caught up in the Genesis Market? Check it here: https://www.politie.nl/en/information/checkyourhack.html#check Thanks to our show sponsor, Normalyze Normalyze is a cloud data security platform that continuously discovers sensitive data and their access paths across your cloud environments. Normalyze provides the ability to analyze, prioritize and respond to data threats to prevent damaging data breaches. Their cloud-native platform manages data security posture and compliance by automatically tracking risks to sensitive...

Criminal records incident, Samsung's ChatGPT leak, Money Message ransomware

Criminal records office yanks web portal offline amid 'cyber security incident' Samsung reportedly leaked its own secrets through ChatGPT Money Message ransomware gang claims MSI breach, demands $4 million Thanks to today's episode sponsor, Normalyze Normalyze is a cloud data security platform that continuously discovers sensitive data and their access paths across your cloud environments. Normalyze provides the ability to analyze, prioritize and respond to data threats to prevent damaging data breaches.Their cloud-native platform manages data security posture and compliance by automatically tracking risks to sensitive data, visually showing teams who can access what, and quickly block unauthorized access or...

Spanish hacker arrested, UK offensive cyber principles, eFile malware

Prominent Spanish hacker arrested The UK's Offensive Cyber Capabilities Principles eFile site serving malware Thanks to today's episode sponsor, Normalyze Normalyze is a cloud data security platform that continuously discovers sensitive data and their access paths across your cloud environments. Normalyze provides the ability to analyze, prioritize and respond to data threats to prevent damaging data breaches.Their cloud-native platform manages data security posture and compliance by automatically tracking risks to sensitive data, visually showing teams who can access what, and quickly block unauthorized access or vulnerable points of attack.Discover, visualize, and secure your cloud data in minutes with Normalyze Freemium....

Genesis Market seized by police, Rorschach now the fastest ransomware encryptor, Tax software serving malware

Genesis Market platform seized by police Rorschach is now the fastest ransomware encryptor Tax return software caught serving up malware Thanks to today's episode sponsor, Normalyze Normalyze is a cloud data security platform that continuously discovers sensitive data and their access paths across your cloud environments. Normalyze provides the ability to analyze, prioritize and respond to data threats to prevent damaging data breaches.Their cloud-native platform manages data security posture and compliance by automatically tracking risks to sensitive data, visually showing teams who can access what, and quickly block unauthorized access or vulnerable points of attack.Discover, visualize, and secure your cloud...

TMX data leak, remote work security, WD network breach

TMX reveals customer data leak The security costs of remote work Western Digital confirms network breach Thanks to today's episode sponsor, Normalyze Normalyze is a cloud data security platform that continuously discovers sensitive data and their access paths across your cloud environments. Normalyze provides the ability to analyze, prioritize and respond to data threats to prevent damaging data breaches.Their cloud-native platform manages data security posture and compliance by automatically tracking risks to sensitive data, visually showing teams who can access what, and quickly block unauthorized access or vulnerable points of attack.Discover, visualize, and secure your cloud data in minutes with...

3CX's NK connection, WordPress Elementor hack, DISH faces lawsuits

More evidence links 3CX supply-chain attack to North Korean hacking group Hackers exploiting WordPress Elementor Pro Vulnerability, leaving millions of sites at risk DISH slapped with multiple lawsuits after ransomware cyber attack Thanks to today's episode sponsor, Normalyze Normalyze is a cloud data security platform that continuously discovers sensitive data and their access paths across your cloud environments. Normalyze provides the ability to analyze, prioritize and respond to data threats to prevent damaging data breaches.Their cloud-native platform manages data security posture and compliance by automatically tracking risks to sensitive data, visually showing teams who can access what, and quickly block...

Week in Review: Supply-chain attack on 3CX, AI pause request, WiFi protocol flaw

Link to Blog Post This week'sCyber Security Headlines Week in Review, March 27-31, is hosted byRich Stroffolinowith our guest,Brett Conlon, CISO,American Century Investments Thanks to today's episode sponsor, Trend Micro Cybersecurity is not just about protection, it's about foresight, agility, and resilience.Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks.Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to Resilience World Tour" The largest...

3CX supply chain attack, Vulkan files leaked, Bing hijacked

Supply-chain attack on business phone provider 3CX could impact thousands of companies Vulkan files leak reveals Putin's global and domestic cyberwarfare tactics Bing search results hijacked via misconfigured Microsoft app Thanks to today's episode sponsor, Trend Micro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks. Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in...

802.11 flaw, activists targeted in threat campaign, call for an AI "pause"

Flaw found in WiFi protocol Environmental activists targeted by threat actors Open letter calls for AI "pause" Thanks to today's episode sponsor, Trend Micro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks. Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to Resilience World Tour" The largest cybersecurity roadshow of its...

Microsoft unveils OpenAI-based cyber tools, Google accused of destroying antitrust evidence, A million pen tests show security is getting worse

Microsoft unveils OpenAI-based chat tools to combat cyberattacks Google accused of willfully destroying evidence in antitrust battle A million pen tests show companies' security postures are getting worse Thanks to today's episode sponsor, Trend Micro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks. Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest...

Pinduoduo malware, CFTC sues Binance, Twitter takes down source code

Pinduoduo malware confirmed Binance sued by CFTC Twitter source code takedown Thanks to today's episode sponsor, Trend Micro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks. Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest "Risk to Resilience World Tour" The largest cybersecurity roadshow of its kind. Find the closest city to...

UK bans TikTok, Windows Snipping patch, Puerto Rico hack

UK bans TikTok from government mobile phones Microsoft pushes OOB security updates for Windows Snipping tool flaw Vice Society claims attack on Puerto Rico Aqueduct and Sewer Authority Thanks to today's episode sponsor, Trend Micro Cybersecurity is not just about protection, it's about foresight, agility, and resilience. Navigating a new era of cyber risk demands evolved strategies, new frameworks, and integrated tools to equip security teams to anticipate and defend against even the most advanced attacks. Trend Micro, the global leader in cybersecurity is bringing the cyber risk conversation to more than 120 cities around the world in their latest...

Week in Review: post-ransomware lawsuits, cybersecurity as a hindrance, ChatGPT imposters

Link to Blog Post This week'sCyber Security Headlines Week in Review, March 20-24, is hosted byDavid Sparkwith our guest,Kurt Sauer, VP, Information security,Workday Thanks to today's episode sponsor, Conveyor Does the thought of answering another security questionnaire make you want to beat the stuffing out of 32 pinatas?Then you might want to check out Conveyor: the end-to-end trust platform helping infosec teams reduce incoming questionnaires and fly through the ones they do have to complete. Give customers access to a self-serve trust portal to download docs and FAQs. For any remaining questionnaires that do come in, use our GPT-Questionnaire response...

Dole data breach, Nexus banking trojan, Pwn2Own Vancouver 2023

Dole discloses data breach after February ransomware attack New Android banking trojan targets financial apps Pwn2Own Vancouver 2023 Day 1: Windows 11 and Tesla hacked Thanks to this week's episode sponsor, Conveyor Does the thought of answering another security questionnaire make you want to beat the stuffing out of 32 pinatas? Then you might want to check out Conveyor: the end-to-end trust platform helping infosec teams reduce incoming questionnaires and fly through the ones they do have to complete. Give customers access to a self-serve trust portal to download docs and FAQs. For any remaining questionnaires that do come in,...

More markup leaks, Clop victims go public, Big Tech lobbies on spy law

Another image editor leaks data More Clop victims come forward Big tech lobbies to limit spying law Thanks to this week's episode sponsor, Conveyor Does the thought of answering another security questionnaire make you feel like clearing out the ice cream section at your local grocery store? Though we fully support the ice cream thing, you might want to check out Conveyor first: the end-to-end trust platform helping infosec teams reduce incoming questionnaires and fly through the ones they do have to complete. Give customers access to a self-serve trust portal to download security info and for any remaining questionnaires...

BreachForums to shut down, Zero-day used to drain Bitcoin ATMs, DC Health Link hacker motivated by Russian patriotism

BreachForums to shut down amidst law enforcement concerns Hackers use zero-day to drain $1.6 million from Bitcoin ATMs DC Health Link hacker motivated by Russian patriotism Thanks to this week's episode sponsor, Conveyor Does the mountain of security questionnaires in your inbox make you feel like a 2 dollar umbrella in a hurricane? Then you might want to check out Conveyor: the end-to-end trust platform helping infosec teams reduce incoming questionnaires and fly through the ones they do have to complete. Give customers access to a self-serve trust portal to download docs and FAQs. For any remaining questionnaires that do...

China leads zero-days, HinataBot DDoS attacks, screenshot vulnerability

China led zero-days in 2022 HinataBot focuses on DDoS attacks Vulnerability lets you uncrop screenshots Thanks to this week's episode sponsor, Conveyor Does the thought of answering another security questionnaire make you want to beat the stuffing out of 32 pinatas? Then you might want to check out Conveyor: the end-to-end trust platform helping infosec teams reduce incoming questionnaires and fly through the ones they do have to complete. Give customers access to a self-serve trust portal to download docs and FAQs. For any remaining questionnaires that do come in, use our GPT-Questionnaire Eliminator response tool or white-glove questionnaire completion...

NBA data breach, Emotet in OneNote, Dutch shipping ransomware

NBA is warning fans of a data breach after a third-party newsletter service hack Emotet malware now distributed in Microsoft OneNote files to evade defenses Dutch shipping giant Royal Dirkzwager confirms Play ransomware attack Thanks to this week's episode sponsor, Conveyor Love security questionnaires? Then you're going to hate Conveyor: the end-to-end trust platform built to eliminate questionnaires. Infosec teams have reduced questionnaires by 80% by giving their customers access to our self-serve trust portal to download docs and answers. For any remaining questionnaires that do come in, use our GPT-Questionnaire Eliminator response tool or white-glove questionnaire completion service to...

Week in Review: Critical Outlook bug PoC, CISA Plex warning, YouTube AI infostealers

Link to Blog Post This week'sCyber Security Headlines Week in Review, March 13-17, is hosted byRich Stroffolinowith our guest,JJ Agha, CISO, FanDuel All links and the video of this episode can be found on CISO Series.com

Telerik breaches Government, Critical Outlook bug, LockBit threatens SpaceX

US Government IIS server breached via Telerik software flaw Critical Microsoft Outlook bug PoC shows how easy it is to exploit LockBit threatens release of thousands of SpaceX blueprints Brought to you by the CISO Series. For the stories behind the headlines, head to CISOseries.com.

Suspects charged in DEA hack, Americans lose billions to scams, TikTok divestment

Two charged in DEA portal hack Americans lose billions in scams TikTok considering divestment Brought to you by the CISO Series.

Microsoft phishing warning, Amazon Ring hacked, CISA's vulnerability program

Microsoft warns of large-scale use of phishing kits to send millions of emails daily Ransomware group claims hack of Amazon's Ring CISA creates new ransomware vulnerability warning program Brought to you by the CISO Series. For the stories behind the headlines, head to CISOseries.com.

North Korea targets security researchers, the UK's National Protective Security Authority, bank failures hit crypto

North Korea targets security researchers UK launches National Protective Security Authority Bank failures bleed into crypto Brought to you by the CISO Series.

Authorities bust NetWire RAT, CISA warns of Plex bug after LastPass breach, Blackbaud to pay $3 million for misleading disclosure

FBI and international authorities catch a NetWire RAT CISA warns of actively exploited Plex bug after LastPass breach Blackbaud to pay $3 million for misleading ransomware disclosure For the stories behind the headlines, visit CISOseries.com.

Week in Review: Royal ransomware warning, water system warning, cloud exploitation rising

Link to Blog Post This week'sCyber Security Headlines Week in Review, March 6-10, is hosted byRich Stroffolinowith our guest,Nick Espinosa, Host, The Deep Dive Radio Show (Daily Podcast&Daily Videos) Thanks to our show sponsor, Packetlabs Trust the ethical hackers at Packetlabs for expert penetration testing services. Our certified professionals specialize in strengthening your security posture. Download our free Penetration Testing Buyers Guide at ciso.packetlabs.netand get the top 20 questions to ask third party vendors before hiring them. Let us guide you through the process and help you find the perfect match for your organization's security needs. All links and the...

Biden's cybersecurity budget, AT&T breach alert, GitHub adds 2FA

Biden's budget seeks increase in cybersecurity spending AT&T alerts 9 million customers of data breach after vendor hack GitHub makes 2FA mandatory next week for active developers Thanks to today's episode sponsor, Packetlabs Trust the ethical hackers at Packetlabs for expert penetration testing services. Our certified professionals specialize in strengthening your security posture. Download our free Penetration Testing Buyers Guide at ciso.packetlabs.net and get the top 20 questions to ask third party vendors before hiring them. Let us guide you through the process and help you find the perfect match for your organization's security needs. For the stories behind the...

TSA cybersecurity regulations, Lazarus Group zero-day, a video ransom note

TSA issues cybersecurity regulations Lazarus Group deploys zero-day Ransomware gang uses video ransom note Thanks to today's episode sponsor, Packetlabs Reduce cyber insurance premiums and minimize risk. Learn how a thorough penetration test can benefit your business. Download our Penetration Testing Buyers Guide at ciso.packetlabs.ca. Packetlabs is an ethical hacking firm that will simulate real-world, covert attacks to get answers to your "what if" scenarios. Protect your business from cyber attacks and get the most out of your penetration testing investment with Packetlabs, your friendly neighborhood ethical hackers.

Bipartisan bill allows US TikTok ban, Twitter content moderation concerns, Emotet malware returns

Bipartisan bill allows for US ban of TikTok EU concerned with Twitter's content moderation plans Emotet malware returns after three-month hiatus Thanks to today's episode sponsor, Packetlabs Looking for the right cybersecurity service provider can be a daunting task. How do you know if they're trustworthy and reliable? Packetlabs has made it easier for you with our free Penetration Testing buyers guide. We've compiled a list of the top 20 questions you should ask potential providers to ensure you make an informed decision. Download the guide today at ciso.packetlabs.net. For the stories behind the headlines, visit CISOseries.com.

DoppelPaymer disrupted, EPA warns about water security, rising cloud exploitation

Police disrupt DoppelPaymer EPA releases cybersecurity notice for water systems Cloud exploitation on the rise Thanks to today's episode sponsor, Packetlabs Struggling to justify cybersecurity investments to decision-makers? Meet ROSI, the superhero of cybersecurity investments! Calculate your Return On Security Investment to quantify the value of prevention and save money by avoiding cybersecurity breaches. ROSI builds synergies between your business, security, and finance teams, bringing everyone together. Download our free buyer's guide to learn the ROSI formula, how to reduce cyber insurance premiums, and what to look for in a provider. Visit ciso.packetlabs.net and unleash the power of ROSI in...

CISA's Royal warning, Chick-fil-A attacked, Play leaks Oakland

U.S. Government warns of Royal ransomware attacks against critical infrastructure Credential Stuffing attack on Chick-fil-A Play Ransomware gang has begun to leak data stolen from City of Oakland Thanks to today's episode sponsor, Packetlabs Concerned about your organization's data security? Privacy breaches, ransomware attacks, insider threats, and intellectual property theft are on the rise. A one-size-fits-all vulnerability assessment scan no longer suffices. Get our Penetration Testing Buyer's guide to help plan, scope, and execute your projects. Discover valuable information on frameworks, standards, methodologies, cost factors, reporting options, and what to look for in a provider. Choose the right ethical hacking...

Week in Review: National Cyber Strategy, CISA scolds software industry, NewsCorp lurked

Link toBlog Post This week's Cyber Security Headlines - Week in Review, February 27-March 3, is hosted by Rich Stroffolino with our guest, Nick Vigier, CISO, Talend Thanks to our show sponsor, Conveyor Just because your security questionnaire is from the stone age, doesn't mean you have to answer it with cave-era tools. At Conveyor, we implemented GPT-3 into our first-of-its-kind questionnaire eliminator so teams of all sizes can blast through questionnaires faster than you can say "prehistoric". Go beyond re-writing mediocre matches, to getting your questionnaire auto-filled with the exact answers customers need. Join the top SaaS companies in...

National Cybersecurity Strategy, CISA delivers Decider, Bookstore chains hacked

White House gets tough with new National Cyber Strategy CISA releases free 'Decider' tool to help with MITRE ATT&CK mapping British retail chain WH Smith says data stolen in cyberattack Thanks to this week's episode sponsor, Conveyor Just because your security questionnaire is from the stone age, doesn't mean you have to answer it with cave-era tools. At Conveyor, we implemented GPT-3 into our first-of-its-kind questionnaire eliminator so teams of all sizes can blast through questionnaires faster than you can say "prehistoric". Go beyond re-writing mediocre matches, to getting your questionnaire auto-filled with the exact answers customers need. Join the...

Russia bans foreign messaging apps, GitHub scans for secrets, Bootkit beats Secure Boot

Russia bans foreign private messaging apps GitHub expands secret scanning Bootkit bypasses Secure Boot Thanks to this week's episode sponsor, Conveyor "I HATE security questionnaires with the fury of a thousand suns." said one of our customers. Makes sense, since tools used to answer them haven't changed in years. At Conveyor, we're on a mission to get teams out of the questionnaire stone age by implementing GPT-3 into our first-of-its-kind questionnaire eliminator. Go beyond re-writing mediocre matches, to getting your questionnaire auto-filled with the exact answers customers need. Join the top SaaS companies in the GPT-3 powered future by using...

US Marshals hit by ransomware, DISH outages caused by ransomware, More bad news for LastPass

US Marshals hit by ransomware DISH outages caused by confirmed ransomware attack Some more bad news for LastPass Thanks to this week's episode sponsor, Conveyor AI can now literally answer any question on the internet in seconds, yet infosec teams are still in a living nightmare manually filling out security questionnaires with existing tools. Get out of the questionnaire stone age with Conveyor's new questionnaire eliminator tool powered by GPT-3. It provides perfectly crafted answers to questionnaires all within minutes and review now takes seconds. Join the top SaaS companies in the GPT-3 powered future by using Conveyor. Learn more...

CISA wants security responsibility, changes in security since Russia invaded Ukraine, Canadian government bans TikTok on its devices

CISA says to stop passing the security buck The cyber security fallout of Russia's war in Ukraine Canada bans TikTok on government devices Thanks to this week's episode sponsor, Conveyor Just because your security questionnaire is from the stone age, doesn't mean you have to answer it with cave-era tools. At Conveyor, we implemented GPT-3 into our first-of-its-kind questionnaire eliminator so teams of all sizes can blast through questionnaires faster than you can say "prehistoric". Go beyond re-writing mediocre matches, to getting your questionnaire auto-filled with the exact answers customers need. Join the top SaaS companies in the GPT-3 powered...

NewsCorp reveals attack, TELUS investigating leak, Dish goes offline

News Corp reveals that attackers remained on its network for two years TELUS investigating leak of stolen source code, employee data Dish Network goes offline after likely cyberattack, employees cut off Thanks to this week's episode sponsor, Conveyor AI can now literally answer any question on the internet in seconds, yet infosec teams are still living a nightmare manually filling out security questionnaires with existing tools. Get out of the questionnaire stone age with Conveyor's new questionnaire eliminator tool powered by GPT-3. Go beyond re-writing mediocre matches, to getting your questionnaire auto-filled with the exact answers customers need in minutes....

Week in Review: European airport attacks, military email spill, Dole ransomware attack

Link to Blog Post This week'sCyber Security Headlines Week in Review, February 20-24, is hosted byRich Stroffolinowith our guest,Jared Mendenhall, Head of Information Security,Impossible Foods Thanks to our show sponsor, Barricade Cyber Have you fallen victim to a ransomware attack? Don't worry! Barricade Cyber Solutions has helped thousands of customers in situations just like yours. Our proprietary ransomware recovery services are designed to quickly get your business back on track. Our team of experts will identify the source of the attack and provide a comprehensive solution to prevent it from happening again. You can count on us for the security...

Dole ransomware attack, stress devours CISOs, new Lazarus backdoor

Fruit giant Dole suffers ransomware attack impacting operations Stress pushing CISOs out the door Lazarus group likely using new backdoor to exfiltrate sensitive data Thanks to this week's episode sponsor, Barricade Cyber Solutions Have you fallen victim to a ransomware attack? Don't worry! Barricade Cyber Solutions has helped thousands of customers in situations just like yours. Our proprietary ransomware recovery services are designed to quickly get your business back on track. Our team of experts will identify the source of the attack and provide a comprehensive solution to prevent it from happening again. You can count on us to the...

Havok framework, Carbon Black flaw, ransomware attack time

Threat actors cry Havoc, let slip a new post-exploitation framework VMware warns of critical Carbon Black flaw Ransomware attack time shrinking rapidly Thanks to this week's episode sponsor, Barricade Cyber Solutions Have you fallen victim to a ransomware attack? Don't worry! Barricade Cyber Solutions has helped thousands of customers in situations just like yours. Our proprietary ransomware recovery services are designed to quickly get your business back on track. Our team of experts will identify the source of the attack and provide a comprehensive solution to prevent it from happening again. You can count on us to the security of...

Apple updates advisories, US military email leak, Russian TV website crash

Apple updates advisories as security firm discloses new class of vulnerabilities Sensitive US military emails spill online Russian state TV website goes down during Putin speech Thanks to this week's episode sponsor, Barricade Cyber Solutions Have you fallen victim to a ransomware attack? Don't worry! Barricade Cyber Solutions has helped thousands of customers in situations just like yours. Our proprietary ransomware recovery services are designed to quickly get your business back on track. Our team of experts will identify the source of the attack and provide a comprehensive solution to prevent it from happening again. You can count on us...

Samsung guards against zero-clicks, ransomware cat and mouse, Norway seizes Laxarus crypto

Samsung guards against zero-click attacks Rethinking ransomware cat and mouse Norway seizes Lazarus Group crypto Thanks to this week's episode sponsor, Barricade Cyber Solutions Have you fallen victim to a ransomware attack? Don't worry! Barricade Cyber Solutions has helped thousands of customers in situations just like yours. Our proprietary ransomware recovery services are designed to quickly get your business back on track. Our team of experts will identify the source of the attack and provide a comprehensive solution to prevent it from happening again. You can count on us to the security of your data and systems. Visit barricadecyber.com

Hackers backdoor Microsoft IIS, Twitter limits SMS 2FA, Fortinet issues patches

Hackers backdoor Microsoft IIS servers with new Frebniis malware Twitter limits SMS-based 2-factor authentication to Blue subscribers only Fortinet issues patches for 40 flaws Thanks to this week's episode sponsor, Barricade Cyber Solutions Have you fallen victim to a ransomware attack? Don't worry! Barricade Cyber Solutions has helped thousands of customers in situations just like yours. Our proprietary ransomware recovery services are designed to quickly get your business back on track. Our team of experts will identify the source of the attack and provide a comprehensive solution to prevent it from happening again. You can count on us to the...

Week in Review: Clop's GoAnywhere claims, Bing Search injection attack, AI flies F-16

Link to Blog Post This week'sCyber Security Headlines Week in Review, February 13-17, is hosted bySean Kellywith our guest,George Al-Koura, CISO,Ruby Thanks to our show sponsor, CISO Series "If it is important it will likely be in the Cyber Security Headlines update in the morning And it allows me and my team to dig in a little more on aspects that might affect our technology stack," said Shawn Bowen, CISO for World Fuel Services. Security leaders listen and make decisions based on what they hear on this very show. Do you have a solution that just needs to find the...

VM Server problems, Google Translate BEC, DFIR burnout increases

February updates break some Windows Server 2022 VMs BEC groups use Google Translate to target high value victims Evolving cyberattacks and alert fatigue creating DFIR burnout Thanks to today's episode sponsor, US, yes, CISO Series "If it is important it will likely be in the Cyber Security Headlines update in the morning And it allows me and my team to dig in a little more on aspects that might affect our technology stack," said Shawn Bowen, CISO for World Fuel Services. Security leaders listen and make decisions based on what they hear on this very show. Do you have a...

Exposed Israeli influence group, a record DDoS attack, Cut cables knocks out airline

Israeli influence group exposed Another day, another record DDoS Cut cables lead to Lufthansa outage Thanks to today's episode sponsor, US, yes, CISO Series "Every week, one of the stories from Cyber Security Headlines comes up in our team meetings," said Brett Conlon, CISO for American Century Investments who admits he starts his day with this very show. And did you know that Cyber Security Headlines has longevity? It's a daily news show but we see significant downloads for four months after episodes air. That means your ad campaign will continue to live long after the premier airing. To learn...

Hackers breached Pepsi Bottling, AI flies F-16 fighter jet, Hyundai and Kia issue security update

Hackers breached Pepsi Bottling network AI has successfully piloted an F-16 fighter jet Hyundai and Kia to update anti-theft software on millions of vehicles Thanks to today's episode sponsor, US, yes, CISO Series "I value Cyber Security Headlines early every morning as it provides me advance notice of what I might need to explore first thing at the start of the day." That's active listener David Cross, SVP, CISO of Oracle SaaS Cloud. And for sponsors of Cyber Security Headlines what you get are the ears and eyes of avid security leaders. Sponsorship includes the podcast, our blog, and our...

Namecheap phishes customers, Bing hit with injection attack, regulators stop BUSD minting

Namecheap sent phishing emails to customers New Bing search hit with injection attack Regulators stop minting of BUSD stablecoin Thanks to today's episode sponsor, US, yes, CISO Series "Those cyber security headlines are fantastic. It's the first thing I look at in the am." That's a quote from active listener Jared Mendenhall, head of information security at Impossible Foods. Cyber Security Headlines is our fastest growing show on the CISO Series network. It's grown 20-fold since we launched. And it did so during the pandemic while other shows started to slide. That's because at only 6-7 minutes every day, Cyber...

Reddit admits breach, Clop exploits GoAnywhere, CISA's VMware fix

Reddit admits it was hacked and data stolen, says "don't panic" Clop ransomware claims it breached 130 orgs using GoAnywhere zero-day CISA has a possibly-maybe fix for VMware ESXi ransomware campaign Thanks to today's episode sponsor, US, yes, CISO Series If you're looking to reach a committed audience of cybersecurity professionals every day, then consider advertising right here on Cyber Security Headlines, a show that consistently ranks in the top ten for tech news on Apple Podcasts in the U.S. That's pretty impressive for a show that's a niche within a niche. Cyber Security Headlines sponsorship includes continuous week-long brand...

Week in Review: Critical CVEs predicted, FAA needs 7 years, background check breach

Link toBlog Post This week'sCyber Security Headlines Week in Review, February 6-10, is hosted byRich Stroffolinowith our guest,Ed Covert, head of Cyber Risk Engineering,Bowhead Specialty Thanks to our show sponsor, us! CISO Series! "If it is important it will likely be in theCyber Security Headlinesupdate in the morning And it allows me and my team to dig in a little more on aspects that might affect our technology stack," said Shawn Bowen, CISO for World Fuel Services. Security leaders listen and make decisions based on what they hear on this very show. Do you have a solution that just needs...

Microsoft Outlook outage, UK/US ransomware sanctions, Killnet IPs published

Microsoft Outlook outage prevents users from sending, receiving emails Britain and US make major move against ransomware gangs by sanctioning seven individuals Experts publish a list of proxy IPs used by the pro-Russia group Killnet Thanks to today's episode sponsor, us, yes, CISO Series "If it is important it will likely be in the Cyber Security Headlines update in the morning And it allows me and my team to dig in a little more on aspects that might affect our technology stack," said Shawn Bowen, CISO for World Fuel Services. Security leaders listen and make decisions based on what they...

NIST IoT encryption, Chinese phones collect PII, the AI chatbot race is on

NIST standardizes crypto for IoT Chinese phones collect PII Chinese firms also working on AI chatbots Thanks to today's episode sponsor, US, yes, CISO Series "Every week, one of the stories from Cyber Security Headlines comes up in our team meetings," said Brett Conlon, CISO for American Century Investments who admits he starts his day with this very show. And did you know that Cyber Security Headlines has longevity? It's a daily news show but we see significant downloads for four months after episodes air. That means your ad campaign will continue to live long after the premier airing. To...

Tech firms race to integrate AI, FAA needs until 2030 to fix safety system, Biden addresses children's online safety

ARMO, Microsoft, Google race to integrate AI into their products FAA needs until 2030 to fix its safety system Biden's State of the Union addresses children's online safety and privacy again Thanks to today's episode sponsor, US, yes, CISO Series "I value Cyber Security Headlines early every morning as it provides me advance notice of what I might need to explore first thing at the start of the day." That's active listener David Cross, SVP, CISO of Oracle SaaS Cloud. And for sponsors of Cyber Security Headlines what you get are the ears and eyes of avid security leaders. Sponsorship...

Cyber insurance predictions, British steel supplier cyber attack, Microsoft pins Charliue Hebdo attack

Cyber insurer predicts a rise in critical CVEs British steel supplier hit by "cyber incident" Microsoft pins recent attack on Charlie Hebdo Thanks to today's episode sponsor, US, yes, CISO Series "Those cyber security headlines are fantastic. It's the first thing I look at in the am." That's a quote from active listener Jared Mendenhall, head of information security at Impossible Foods. Cyber Security Headlines is our fastest growing show on the CISO Series network. It's grown 20-fold since we launched. And it did so during the pandemic while other shows started to slide. That's because at only 6-7 minutes...

Fortra ZeroDay, Tallahassee hospital cyberattack, sneaky Fraudulent apps

Hackers actively exploiting zero-day in Fortra's GoAnywhere MFT Tallahassee hospital diverting patients, canceling non-emergency surgeries after cyberattack Fraudulent "CryptoRom" apps slip through Apple and Google App Store review process Thanks to today's episode sponsor, US, yes, CISO Series If you're looking to reach a committed audience of cybersecurity professionals every day, then consider advertising right here on Cyber Security Headlines, a show that consistently ranks in the top ten for tech news on Apple Podcasts in the U.S. That's pretty impressive for a show that's a niche within a niche. Cyber Security Headlines sponsorship includes continuous week-long brand awareness in...

Week in Review: Charter Communications breach, ChatGPT grows stronger, Microsoft verifies phishers

Link to Blog Post This week's Cyber Security Headlines - Week in Review, January 30-February 3, is hosted by Rich Stroffolino with our guest, David Nolan, VP, Enterprise Risk & Chief Information Security Officer Aaron's Thanks to our show sponsor, Hunters Hunters is a complete SOC platform, purpose built for your Security Operations team. Hunters' brand new IOC Search is a game-changing search tool that determines if a known 'Indicator of Compromise' has been in your organization's environment - without needing to write a single line of code. Type an IOC into the search bar, hit 'enter' and get results...

London ransomware alert, FDIC cyberdefense fail, UK fears ChatGPT

City of London on high alert after ransomware attack Watchdog warns FDIC fails to test banks' cyberdefenses effectively Foreign states already using ChatGPT maliciously, UK IT leaders believe Thanks to this week's episode sponsor, Hunters Hunters is a complete SOC platform, purpose built for your Security Operations team. Hunters' brand new IOC Search is a game-changing search tool that determines if a known 'Indicator of Compromise' has been in your organization's environment - without needing to write a single line of code. Type an IOC into the search bar, hit 'enter' and get results within seconds. Visithunters.aito learn more. For...

FDIC cyber risk improvements, high-risk containers, record crypto hacks

Watchdog calls for improved bank cyber testing Containers hold high-risk vulnerabilities 2022 set a record for crypto hacks Thanks to this week's episode sponsor, Hunters Hunters is a complete SOC platform, purpose built for your Security Operations team. Hunters' brand new IOC Search is a game-changing search tool that determines if a known 'Indicator of Compromise' has been in your organization's environment - without needing to write a single line of code. Type an IOC into the search bar, hit 'enter' and get results within seconds. Visithunters.aito learn more.

Microsoft phishers are 'Verified' Cloud Partners, DocuSign brand impersonation attack, Google Fi data breach

Microsoft grants phishers 'Verified' Cloud Partner status DocuSign brand impersonation attack targets thousands of users Google Fi says hackers accessed customer information Thanks to this week's episode sponsor, Hunters Hunters is a SaaS platform, purpose built for your Security Operations team. Solaris Group, a leading German FinTech, implemented Hunters SOC Platform to eliminate the burden of threat detection and correlation allowing SOC analysts to focus on higher-value tasks. It's time to move beyond SIEM. Visithunters.aito learn more. For the stories behind the headlines, visit CISOseries.com

Criminal crypto flows, TikTok CEO heads to the House, Killnet launches German DDoS

Criminal crypto goes through 5 exchanges TikTok CEO heads to the House KillNet launches German DDoS Thanks to this week's episode sponsor, Hunters The Hunters SOC Platform helps your security team identify, understand, triage, and respond to incidents at a much faster pace. ChargePoint, the world's largest network of electric vehicle charging stations, uses Hunters SOC Platform to leverage its out-of-the-box detection content to more efficiently respond to new threats and vulnerabilities. VisitHunters.aito learn more.

Charter Communications breach, Sandworm hacks Ukraine, VMware exploit release

Charter Communications says vendor breach exposed some customer data Russia's Sandworm hackers blamed in fresh Ukraine malware attack Experts plans to release VMware vRealize log RCE exploit this week Thanks to this week's episode sponsor, Hunters Hunters is a complete SOC platform, built for your security team. By providing unlimited ingestion and normalization of security data without ruining your bottom line, a CISO at a leading online retailer was able to "triple her data ingestion while cutting costs from her SIEM provider by 75%." It's time to move beyond SIEM, with Hunters. Visit hunters.ai to learn more. For the stories...

Week in Review: FBI seizes Hive, PayPal accounts breached, ODIN Intelligence hack

Link to Blog Post This week'sCyber Security Headlines Week in Review, January 23-27, is hosted byDavid Sparkwith our guest,Kathleen Mullin, CISO,Cancer Treatment Centers of America Thanks to our show sponsor, SafeBase If a prospective customer asked about your trust program or security policies, where would you send them? Chances are, you'd need to send an NDA, hunt down documentation, go back and forth via email, and answer a litany of questions. SafeBase is the better way. SafeBase's Smart Trust Center allows you to send *one link* to customers or buyers, so they can easily access the security and compliance information...

FBI seizes Hive, Layoffs at IBM, Microsoft outage over

FBI seizes Hive ransomware group infrastructure after lurking in servers for months Layoffs come to IBM - Kyndryl, Watson and Russia to blame Microsoft says services have recovered after widespread outage Thanks to this week's episode sponsor, SafeBase If a prospective customer asked about your trust program or security policies, where would you send them? Chances are, you'd need to send an NDA, hunt down documentation, go back and forth via email, and answer a litany of questions. SafeBase is the better way. SafeBase's Smart Trust Center allows you to send *one link* to customers or buyers, so they can...

North Korean crypto tactics, Russian DDoS record, China tech exports

A look at North Korean crypto stealing tactics Russia saw record DDoS attacks China leads in facial recognition tech exports Thanks to this week's episode sponsor, SafeBase These days, customer trust can be an organization's strongest competitive advantage. But how can you develop and maintain customer trust over the long term? The answer is SafeBase. After implementing SafeBase's Smart Trust Center, many companies see shorter deal cycles, higher-value contracts, and stronger long-term customer relationships. Some even achieve a 90% reduction in security questionnaires. Learn more at safebase.com

Pakistan investigating nationwide blackout, FBI identifies Horizon Bridge hackers, GoTo hack larger than first reported

Pakistani authorities investigating whether cyberattack caused nationwide blackout FBI identifies hackers behind Horizon Bridge crypto theft GoTo says hackers stole encrypted backups and MFA settings Thanks to this week's episode sponsor, SafeBase Jump start your journey to long-lasting customer trust with SafeBase. Our Smart Trust Center helps your organization build customer trust through improved transparency, secure document sharing, process control and insights, and proactive communication. Security and GRC leaders at companies like Jamf, Instacart, and Snyk all rely on SafeBase as a central enabler of their trust program. Learn more and check out the case studies at SafeBase.com For the...

LA School leaks, GAO security ignored, PLAY ransomware in UK

LA School attack exposed Social Security numbers Government Accountability Office names and shames PLAY ransomware hits UK car dealerships Thanks to this week's episode sponsor, SafeBase If a prospective customer asked about your trust program or security policies, where would you send them? Chances are, you'd need to send an NDA, hunt down documentation, go back and forth via email, and answer a litany of questions. SafeBase is the better way. SafeBase's Smart Trust Center allows you to send *one link* to customers or buyers, so they can easily access the security and compliance information they need. Meanwhile, you get...

PayPal accounts breached, Yum! Brands attacked, ODIN Intelligence hacked

PayPal accounts breached in large-scale credential stuffing attack Ransomware gang steals data from KFC, Taco Bell, and Pizza Hut brand owner ODIN Intelligence hack exposes a huge trove of police raid files Thanks to this week's episode sponsor, SafeBase These days, customer trust can be an organization's strongest competitive advantage. But how can you develop and maintain customer trust over the long term? The answer is SafeBase. After implementing SafeBase's Smart Trust Center, many companies see shorter deal cycles, higher-value contracts, and stronger long-term customer relationships. Some even achieve a 90% reduction in security questionnaires. Learn more at safebase.com For...

Week in Review: NortonLifeLock password breach, Ransomware revenue falls, ChatGPT goes phishing

Link to Blog Post This week's Cyber Security Headlines - Week in Review, January 16-20, is hosted by Rich Stroffolino with our guest, George Finney, CISO, Southern Methodist University Thanks to our show sponsor, Cerby Did you know that over 60% of the cloud applications used by your company don't support identity standards like single sign-on? And that these applications are the leading cause of breaches? Cerby can help. Cerby discovers new applications, eliminates manual security tasks like offboarding, and addresses misconfigurations like disabled 2FA while increasing employee productivity. Wait. A security tool that increases productivity? Yup. Learn more at...

Ransomware revenue falls, Vice attacks university, Android Hook malware

Ransomware revenue falls by $300 million in 2022 as more victims refuse to pay Vice Society claims ransomware attack against University of Duisburg-Essen Android users beware of new Hook malware with RAT capabilities Thanks to today's episode sponsor, Cerby Did you know that over 60% of the cloud applications used by your company don't support identity standards like single sign-on? And that these applications are the leading cause of breaches? Cerby can help. Cerby discovers new applications, eliminates manual security tasks like offboarding, and addresses misconfigurations like disabled 2FA while increasing employee productivity. Wait. A security tool that increases productivity?...

Bypassing patches, ChatGPT polymorphic malware, Bitwarden goes passwordless

Vendors bypassing security patches ChatGPT creates polymorphic malware Bitwarden acquires Passwordless.dev Thanks to today's episode sponsor, Cerby Did you know that over 60% of the cloud applications used by your company don't support identity standards like single sign-on? And that these applications are the leading cause of breaches? Cerby can help. Cerby discovers new applications, eliminates manual security tasks like offboarding, and addresses misconfigurations like disabled 2FA while increasing employee productivity. Wait. A security tool that increases productivity? Yup. Learn more at cerby.com.

Ransomware impacts 1,000 ships, Crypto influencer victimized by malware, Microsoft patches Azure flaws

Ransomware attack impacts 1,000 ships Crypto influencer victimized by malware pushed by ads on Google Microsoft patches flaws in Azure cloud services Thanks to today's episode sponsor, Cerby Did you know that over 60% of the cloud applications used by your company don't support identity standards like single sign-on? And that these applications are the leading cause of breaches? Cerby can help. Cerby discovers new applications, eliminates manual security tasks like offboarding, and addresses misconfigurations like disabled 2FA while increasing employee productivity. Wait. A security tool that increases productivity? Yup. Learn more at cerby.com. For the stories behind the headlines,...

Cyber attack disrupts esports, Qbot overtakes Emotet, CircleCI breached

Cyber attack disrupts esport event Qbot overtakes Emotet CircleCI breach caused by infostealer Thanks to today's episode sponsor, Cerby Did you know that over 60% of the cloud applications used by your company don't support identity standards like single sign-on? And that these applications are the leading cause of breaches? Cerby can help. Cerby discovers new applications, eliminates manual security tasks like offboarding, and addresses misconfigurations like disabled 2FA while increasing employee productivity. Wait. A security tool that increases productivity? Yup. Learn more at cerby.com.

NortonLifeLock password breach, Canadian liquor hack, severe jsonwebtoken flaw

NortonLifeLock warns that hackers breached Password Manager accounts Hacker steals credit card info from Canada's largest alcohol retailer Severe security flaw found in "jsonwebtoken" library Thanks to today's episode sponsor, Cerby Did you know that over 60% of the cloud applications used by your company don't support identity standards like single sign-on? And that these applications are the leading cause of breaches? Cerby can help. Cerby discovers new applications, eliminates manual security tasks like offboarding, and addresses misconfigurations like disabled 2FA while increasing employee productivity. Wait. A security tool that increases productivity? Yup. Learn more at cerby.com. For the stories...

Week in Review: FAA system failure delays flights, LastPass hit with lawsuit, Writing malware with ChatGPT

Link to Blog Post This week'sCyber Security Headlines Week in Review, January 9-13, is hosted byRich Stroffolinowith our guest,Shaun Marion, CISO,McDonald's Thanks to our show sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms like Salesforce and Microsoft? What about the data these apps can access? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk.With AppOmni, you get visibility to all third party apps and SaaS-to-SaaS connections including which end users have enabled them, and the level of data access they've been granted. VisitAppOmni.comto request a free...

Chromium browser flaw, Twitter leak developments, IcedID strikes again

Experts detail Chromium browser security flaw putting confidential data at risk Twitter says 200 million-user leak not obtained from its systems, others disagree IcedID malware strikes again: Active Directory domain compromised in under 24 hours Thanks to today's episode sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms like Salseforce and Microsoft? What about the data these apps can access? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps and SaaS-to-SaaS connections including which end users have...

FAA system failure, Royal Mail cyber incident, police app leaks ops data

FAA system failure delays flights Royal Mail hit by "cyber incident" Police app leaked operations data Thanks to today's episode sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms like Salseforce and Microsoft? What about the data these apps can access? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps and SaaS-to-SaaS connections including which end users have enabled them, and the level of data access they've been granted. Visit AppOmni.com to request a free risk assessment.

Iowa schools closed by cyberattack, TikTok CEO questioned by EU, OIG cracks fed agency passwords

Iowa school district cancels classes due to cyberattack TikTok CEO questioned by EU about its data practices Government watchdog cracks federal agency's passwords Thanks to today's episode sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms like Salseforce and Microsoft? What about the data these apps can access? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps and SaaS-to-SaaS connections including which end users have enabled them, and the level of data access they've been granted. Visit...

Car API flaws, Experian bypass, ChatGPT malware

API vulnerabilities found across car brands Bypassing Experian Security Trying to write malware with ChatGPT Thanks to today's episode sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms like Salseforce and Microsoft? What about the data these apps can access? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps and SaaS-to-SaaS connections including which end users have enabled them, and the level of data access they've been granted. Visit AppOmni.com to request a free risk assessment.

Turla hackers return, LastPass faces lawsuit, Windows reporter hacked

Russian Turla hackers hijack decade-old malware infrastructure to deploy new backdoors LastPass hit with lawsuit over August breach Hackers abuse Windows error reporting tool to deploy malware Thanks to today's episode sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms like Salseforce and Microsoft? What about the data these apps can access? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps and SaaS-to-SaaS connections including which end users have enabled them, and the level of data access...

Week in Review: PyTorch malicious compromise, Ransomware cloned victim, LockBit gang apologizes

Link to Blog Post This week'sCyber Security Headlines Week in Review, January 2-6, is hosted bySean Kellywith our guest,Bryan Willett, CISO,Lexmark Thanks to our show sponsor, AppOmni Did you know that over half of companies have sensitive SaaS data exposed on the public internet? And many breaches making headlines now involve SaaS apps? AppOmni can help. AppOmni identifies misconfigurations and guides remediation to keep your SaaS data secure. We help Security teams make sense of data access permissions, third party app visibility, and threat detection across their entire SaaS ecosystem. Get started atAppOmni.com. All links and the video of this...

Slack's GitHub theft, CircleCI breach warning, NATO tests AI

Slack's private GitHub code repositories stolen over holidays CircleCI warns of security breach rotate your secrets! NATO tests AI's ability to protect critical infrastructure against cyberattacks Thanks to today's episode sponsor, AppOmni Did you know that over half of companies have sensitive SaaS data exposed on the public internet? And many breaches making headlines now involve SaaS apps? AppOmni can help. AppOmni identifies misconfigurations and guides remediation to keep your SaaS data secure. We help Security teams make sense of data access permissions, third party app visibility, and threat detection across their entire SaaS ecosystem. Get started at AppOmni.com. For...

'Mudge' joins Rapid7, Meta fined $400 million, GDPR costs Coinbase $100 million

'Mudge' joins cybersecurity firm Rapid7 Meta fined $400 million by European regulator Coinbase strikes a $100 million deal with regulators Thanks to today's episode sponsor, AppOmni Did you know that over half of companies have sensitive SaaS data exposed on the public internet? And many breaches making headlines now involve SaaS apps? AppOmni can help. AppOmni identifies misconfigurations and guides remediation to keep your SaaS data secure. We help Security teams make sense of data access permissions, third party app visibility, and threat detection across their entire SaaS ecosystem. Get started at AppOmni.com. For the stories behind the headlines, visit...

FTX founder pleads not guilty, LA housing authority cyberattack, Ukrainian vishing operation bust

FTX founder has pleaded not guilty to fraud charges LA housing authority operations disrupted by cyberattack Ukrainian authorities bust major vishing call center Thanks to today's episode sponsor, AppOmni Did you know that over half of companies have sensitive SaaS data exposed on the public internet? And many breaches making headlines now involve SaaS apps? AppOmni can help. AppOmni identifies misconfigurations and guides remediation to keep your SaaS data secure. We help Security teams make sense of data access permissions, third party app visibility, and threat detection across their entire SaaS ecosystem. Get started at AppOmni.com. For the stories behind...

Google tracking lawsuits, ransomware victim cloned, LockBit hospital apology

Google to pay $29.5 million to settle lawsuits over user location tracking Ransomware gang cloned victim's website to leak stolen data LockBit gang apologizes, gives SickKids Hospital free decryptor Thanks to today's episode sponsor, AppOmni Did you know that over half of companies have sensitive SaaS data exposed on the public internet? And many breaches making headlines now involve SaaS apps? AppOmni can help. AppOmni identifies misconfigurations and guides remediation to keep your SaaS data secure. We help Security teams make sense of data access permissions, third party app visibility, and threat detection across their entire SaaS ecosystem. Get started...

NetGear urgent patch, malicious PyTorch compromise, LockBit ransoms Lisbon

NETGEAR fixes a severe bug in its routers. Patch it ASAP! PyTorch discloses malicious dependency chain compromise over holidays LockBit ransomware claims attack on Port of Lisbon in Portugal Thanks to today's episode sponsor, AppOmni Did you know that over half of companies have sensitive SaaS data exposed on the public internet? And many breaches making headlines now involve SaaS apps? AppOmni can help. AppOmni identifies misconfigurations and guides remediation to keep your SaaS data secure. We help Security teams make sense of data access permissions, third party app visibility, and threat detection across their entire SaaS ecosystem. Get started...

Google Home snooping, 3Commas API leak, Ireland investigating Twitter data sale

Snooping bug found on Google Home speakers 3Commas API database leaked Ireland investigating Twitter users data for sale Thanks to this week's episode sponsor, Tines Tines is the solution for security teams struggling with too much work, a talent shortage, and inevitable security incidents. Tines breaks the silos that exist between technologies and teams, so employees can focus on meaningful, not menial, tasks. Fewer manual errors and faster response times. Visit Tines.com to learn more.

Ransomware hammers hospitals, Citrix servers not applying patches, Log4Shell at 1-year old

Ransomware continues to hammer hospitals Citrix servers found vulnerable despite patches Log4Shell celebrates an anniversary Thanks to this week's episode sponsor, Tines If you're overwhelmed by your workload, Tines is the solution you've been looking for. Tines no-code automation checks boxes legacy SOAR tools can only dream of. Break the silos between tools and teams, focus on meaningful work, and eliminate manual errors while improving your response times. Visit Tines.com to stay ahead of the curve without breaking a sweat!

Facebook reaches Cambridge Analytica settlement, BTC.com lost $3 million in cyberattack, Hackers steal $8 million from BitKeep users

Facebook reaches settlement related to Cambridge Analytica scandal BTC.com lost $3 million in cyberattack Hackers use trojan to steal $8 million from BitKeep users Thanks to this week's episode sponsor, Tines Ever feel like you're stuck in a never-ending cycle of alerts? It's exhausting and frustrating. But here's the good news: Tines! Tines helps you focus on meaningful, not menial, tasks. Fewer mistakes, faster response times. And best of all, Tines' no-code automation platform can handle massive complexity and easily connect to your unique tech stack. Visit Tines.com now! For the stories behind the headlines, visit CISOseries.com

Severe LastPass breach, Inglis resigns post, Xfinity accounts hacked

LastPass admits to severe data breach, encrypted password vaults stolen Chris Inglis to resign as national cyber director Comcast Xfinity accounts hacked in widespread 2FA bypass attacks Thanks to our episode sponsor, Tines Wondering how the world's leading security teams are figuring out how to do more with less? The answer is Tines! Tines is a hyper-flexible automation platform loved by customers like Okta, Canva, Kayak, and Coinbase. Tines enables security teams to focus on what matters most by taking care of the grunt work! Learn more atTines.com. For the stories behind the headlines, head to CISOseries.com.

Malware in search ads, Guardian hit with ransomware, Okta source code accessed

FBI warns of malware in search ads Guardian hit with suspected ransomware Attackers grab Okta source code Thanks to this week's episode sponsor, Tines Tis the season for more alerts and fewer resources available to manage them. But you can still be jolly--with Tines! Tines eliminates the need for security teams to waste time on repetitive, manual tasks. Powered by a no-code approach, security teams createand maintainpowerful automations that deliver immediate results. Visit Tines.com to learn more!

McGraw Hill data leak, UK ICO names breached firms, Twitter aided Pentagon propaganda

McGraw Hill exposed student grades and personal info UK privacy regulator names and shames breached firms Twitter aided the Pentagon in covert online propaganda campaign Thanks to this week's episode sponsor, Tines If you're like most security teams, you currently face more phishing attacks and alert fatigue. The holiday season is the most wonderful time of the year for shoppers... but it's also a busy time for cybercriminals. Tines' no-code automation platform can help you transform your SecOps and stay one step ahead. Visit Tines.com to sign up for free today! For the stories behind the headlines, visit CISOseries.com

Cyber Security Headlines: Glupteba botnet returns, the future of ransomware, and Epic Games' privacy fine

Botnet shrugs off Google The future of ransomware Epic Games receives record privacy fines Thanks to this week's episode sponsor, Tines If you're like most security teams, you're juggling multiple mission-critical priorities. But what if there was a way to break the silos in your environment? A way to focus on meaningful tasks? A way to reduce errors and achieve faster response times? Check out Tines.com to start experiencing the true benefits of proactive security operations powered by no-code automation.

Russia infiltrates satellites, Gmail's end-to-end encryption, NSA's Russia warning

CISA says Russia's Fancy Bear infiltrated US satellite network Google introduces end-to-end encryption for Gmail on the web NSA cyber director warns of Russian digital assaults on global energy sector Thanks to this week's episode sponsor, Tines Before Tines, co-founders Eoin and Thomas spent 15 years as senior security operators. Frustrated by the inability to solve for the challenges their teams were facing, they built their own solution. Tines allows security teams to robustly automate mundane, repetitive tasks without code so they can focus on their most important work. Visit Tines.com to learn more! For the stories behind the headlines,...

Week in Review: Antivirus data wipers, TSA expands facial recognition, Uber breach

Link to Blog Post This week'sCyber Security Headlines Week in Review, December 12-16, is hosted byRich Stroffolinowith our guest,Jeremy Embalabala, CISO,HUB International Thanks to our show sponsor, Fortra The cybersecurity landscape is full of single-solution providers, making it easy for unexpected cyberthreats to sneak through the cracks. That's why Fortra is creating a stronger, simpler strategy for protection. One that increases your security maturity while decreasing the operational burden that comes with it. Fortra's integrated, scalable solutions help customers face their toughest challenges with confidence. Learn more at Fortra.com All links and the video of this episode can be found...

Japanese MirrorStealer malware, HTML smuggling SVGs, DDoS-for-hire arrests

Hackers target Japanese politicians with new MirrorStealer malware Crooks use HTML smuggling to spread QBot malware via SVG files FBI charges 6, seizes domains linked to DDoS-for-hire service platforms Thanks to this week's episode sponsor, Fortra The cybersecurity landscape is full of single-solution providers, making it easy for unexpected cyberthreats to sneak through the cracks. That's why Fortra is creating a stronger, simpler strategy for protection. One that increases your security maturity while decreasing the operational burden that comes with it. Fortra's integrated, scalable solutions help customers face their toughest challenges with confidence. Learn more at Fortra.com. For the stories...

EU drafts new US-data sharing agreement, Microsoft signed malicious drivers, InfraGard data leak

EU gets closer to US-data sharing agreement Microsoft signed malicious drivers InfraGard data for sale on dark web Thanks to this week's episode sponsor, Fortra The cybersecurity landscape is full of single-solution providers, making it easy for unexpected cyberthreats to sneak through the cracks. That's why Fortra is creating a stronger, simpler strategy for protection. One that increases your security maturity while decreasing the operational burden that comes with it. Fortra's integrated, scalable solutions help customers face their toughest challenges with confidence. Learn more at Fortra.com.

Twitter data leak, Uber hit with another breach, Chinese police arrest crypto laundering gang

Twitter addresses claims of recent data leak Uber hit with another breach after attack on third-party vendor Police in China arrest gang who laundered $1.7 billion via crypto Thanks to this week's episode sponsor, Fortra The cybersecurity landscape is full of single-solution providers, making it easy for unexpected cyberthreats to sneak through the cracks. That's why Fortra is creating a stronger, simpler strategy for protection. One that increases your security maturity while decreasing the operational burden that comes with it. Fortra's integrated, scalable solutions help customers face their toughest challenges with confidence. Learn more at Fortra.com. For the stories behind...

India leaks expat passport info, Cloudflare expands free security tools, Greece outlaws spyware

India's foreign ministry leaks passport details Cloudflare Zero Trust suite available to at-risk groups Greece outlaws spyware Thanks to this week's episode sponsor, Fortra The cybersecurity landscape is full of single-solution providers, making it easy for unexpected cyberthreats to sneak through the cracks. That's why Fortra is creating a stronger, simpler strategy for protection. One that increases your security maturity while decreasing the operational burden that comes with it. Fortra's integrated, scalable solutions help customers face their toughest challenges with confidence. Learn more at Fortra.com.

Pwn2Own Toronto winners, EDR data wipers, MuddyWater's new campaign

Pwn2Own Toronto 2022 nets almost $1M for 63 zero days Antivirus and EDR solutions tricked into acting as data wipers Iran-linked MuddyWater APT launches new campaign Thanks to this week's episode sponsor, Fortra The cybersecurity landscape is full of single-solution providers, making it easy for unexpected cyberthreats to sneak through the cracks. That's why Fortra is creating a stronger, simpler strategy for protection. One that increases your security maturity while decreasing the operational burden that comes with it. Fortra's integrated, scalable solutions help customers face their toughest challenges with confidence. Learn more at Fortra.com. For the stories behind the headlines,...

Week in Review: DHS reviews Lapsus$, AI generated malware, unsupported applications warning

Link to Blog Post This week'sCyber Security Headlines Week in Review, December 5-9, is hosted byRich Stroffolinowith our guest,Ken Athanasiou, CISO,VF Corporation Thanks to our show sponsor, PlexTrac The best pentesting teams trust PlexTrac. PlexTrac can improve efficiency and effectiveness at every phase of your proactive assessments. By centralizing the data from all your automation tools, cataloging important reusable content for easy access, and promoting communication and visibility at every phase of an assessment, PlexTrac cuts reporting time in half and adds value between reports. Check outPlexTrac.com/CISOSeriesto learn why PlexTrac is the premier pentest reporting and collaboration platform. All links...

APT37 exploits zero-day, Firewalls bypassed generically, Zombinder's Android malware

North Korea-linked APT37 exploits Internet Explorer zero-day flaw Firewalls of several major vendors bypassed with generic attack method New 'Zombinder' platform binds Android malware with legitimate apps Thanks to today's episode sponsor, PlexTrac The best pentesting teams trust PlexTrac. PlexTrac can improve efficiency and effectiveness at every phase of your proactive assessments. By centralizing the data from all your automation tools, cataloging important reusable content for easy access, and promoting communication and visibility at every phase of an assessment, PlexTrac cuts reporting time in half and adds value between reports. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the premier...

Pentagon cloud deal, Apple now encrypts iCloud backups, CloudSEK hacked by cybersecurity firm?

Pentagon awards cloud deal to four major providers Apple finally adds encryption to iCloud backups CloudSEK claims it was hacked by another cybersecurity firm Thanks to today's episode sponsor, PlexTrac The Plextrac platform is your offensive security team's secret weapon. Build better reports in half the time, centralize your data, maximize your reusable content, and become more efficient and effective. PlexTrac clients report a "5X ROI in 1 year," a "30% increase in efficiency," have "cut their reporting cycle by 65%," and experienced a "18 to 22% time savings per engagement." Check out PlexTrac.com/CISOSeries to learn how PlexTrac can help...

AI generated malware, Rackspace confirms ransomware, Meta Oversight Board rules on cross-check

Are we in the age of AI generated malware Rackspace confirms ransomware attack Meta Oversight Board rules on cross-check system Thanks to today's episode sponsor, PlexTrac The best pentesting teams trust PlexTrac. PlexTrac can improve efficiency and effectiveness at every phase of your proactive assessments. By centralizing the data from all your automation tools, cataloging important reusable content for easy access, and promoting communication and visibility at every phase of an assessment, PlexTrac cuts reporting time in half and adds value between reports. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the premier pentest reporting and collaboration platform.

Baseboard software vulnerabilities, threat group stole COVID funds, AI generated code

Vulnerabilities found in popular baseboard software Chinese threat group stole COVID-19 relief funds The question of AI generated code Thanks to today's episode sponsor, PlexTrac The Plextrac platform is your offensive security team's secret weapon. Build better reports in half the time, centralize your data, maximize your reusable content, and become more efficient and effective. PlexTrac clients report a "5X ROI in 1 year," a "30% increase in efficiency," have "cut their reporting cycle by 65%," and experienced a "18 to 22% time savings per engagement." Check out PlexTrac.com/CISOSeries to learn how PlexTrac can help your team deliver results.

Fosshost goes dark, DHS reviews Lapsus$, Rackspace security incident

Open source software host Fosshost shutting down, CEO unreachable DHS Cyber Safety Review Board to review Lapsus$ attacks Rackspace rocked by 'security incident' that has taken out hosted Exchange services Thanks to today's episode sponsor, PlexTrac The best pentesting teams trust PlexTrac. PlexTrac can improve efficiency and effectiveness at every phase of your proactive assessments. By centralizing the data from all your automation tools, cataloging important reusable content for easy access, and promoting communication and visibility at every phase of an assessment, PlexTrac cuts reporting time in half and adds value between reports. Check out PlexTrac.com/CISOSeries to learn why PlexTrac...

Week in Review: Encouraging cyber volunteers, TikTok invisible malware, SiriusXM car issues

Link to Blog Post This week'sCyber Security Headlines Week in Review, November 28-December 2, is hosted byRich Stroffolinowith our guest,Terrance Cooley, CISO, Air Force JADC2 R&D Center. Thanks to our show sponsor, Automox Are you ready to ditch manual patching and all the complexity and hassle that comes with it? With Automox, you can automatically patch your Windows, macOs, and Linux devices with one easy-to-use, cloud-native platform. Modern patching should be easy. And now it is. With automated cross-OS patching, you'll save time and sleep better at night knowing your IT environment is secure. VisitAutomox.comto learn more and start a...

LastPass data accessed, Sirius smartcar flaw, Medibank data dump

Intruders gain access to user data in LastPass incident Sirius XM flaw unlocks smart cars thanks to code flaw Medibank hackers announce 'case closed' and dump huge data file on dark web Thanks to this week's episode sponsor, Automox And now a word from our sponsor, Automox. Are you ready to ditch manual patching and all the complexity and hassle that comes with it? With Automox, you can automatically patch your Windows, macOs, and Linux devices with one easy-to-use, cloud-native platform. Modern patching should be easy. And now it is. With automated cross-OS patching, you'll save time and sleep better...

White House targeted, Google links spyware, Android apps fake accounts

Elon Musk's Starlink and the White House targeted by Killnet hackers Google links Windows exploit framework used to send spyware Malicious Android app creates fake accounts on multiple platforms Thanks to this week's episode sponsor, Automox Threat exposure is a growing business risk. Today, vulnerabilities are piling up faster than traditional remediation processes and tools can fix them. But fixing vulnerabilities doesn't have to be a fire drill. Now you can eliminate threats and manage exposed endpoints with Automox Automated Vulnerability Remediation, the only cloud-native solution that harmonizes your SecOps and ITOps workflow and lets you fix vulnerabilities dramatically faster...

TikTok Challenge malware, Cyber Monday record, Sandworm's Ukraine attack

Hackers use trending TikTok 'Invisible Challenge' to spread malware Cyber Monday online sales hit record Sandworm gang launches Monster ransomware attacks on Ukraine Thanks to this week's episode sponsor, Automox Are you tired of using multiple tools to patch your third-party applications? With Automox you'll gain complete visibility of all your software and the ability to patch it, automatically, from a single platform. Fix missing third-party patches with the click of a button to dramatically reduce the time, effort, and complexity it takes to maintain a strong security posture. Visit Automox.com to learn more and start a free trial today....

Google warns of "patch gap," Chinese spam hits Twitter

Project Zero warns of "patch gap" Twitter hit with spam campaign Canadian food company refuses ransom demands Thanks to this week's episode sponsor, Automox Are you ready to say goodbye to manual patching? With Automox you can automatically patch your Windows, macOs, and Linux devices with one easy-to-use, cloud-native platform. Modern patching can and should be easy. Save time and sleep better at night knowing your IT environment is secure with automated cross-OS patching. Visit Automox.com to learn more and start a free trial today.

FCC China ban, Windows servers freeze, WhatsApp data leak

FCC announces ban on Chinese telecom and surveillance equipment New Windows Server updates cause domain controller freezes, restarts WhatsApp data leak: 500 million user records for sale Thanks to this week's episode sponsor, Automox Automox allows you to automate the configuration, patching, and compliance of your Windows, macOS, and Linux systems all from the cloud. Visit Automox.com to start a free trial and have all your endpoints safe and secure in just 15 minutes. Automox is also offering special pricing from now until December 31st so you can start 2023 off right and get automated patching without breaking your budget....

Twitter enlists George Hotz, $575 million crypto scheme, DrafKings $300K theft

Twitter enlists hacker George Hotz for 12 week "internship" Estonian duo arrested for masterminding $575 million Ponzi scheme Hackers steal $300K from DraftKings customers Thanks to today's episode sponsor, Compyl Preparing a Thanksgiving meal can be stressful, but managing your security and compliance program doesn't have to be. Compyl quickly integrates with the tools you use, and automates 85% of the day-to-day tasks, all while providing complete visibility and comprehensive reporting along the way. Learn about Compyl today at www.compyl.com. For the stories behind the headlines, visit CISOseries.com

Emotet returns, Google helps with Cobalt Strike, Ticketmaster blames bots for Swift snafu

Emotet returns with a malspam vengeance Google publishes YARA rules for Cobalt Strike Ticketmaster blames "bot attacks" for ticketing fiasco Thanks to today's episode sponsor, Compyl This thanksgiving, sit around the table and be thankful for Compyl. Compyl is an all-in-one platform that supercharges your security program and takes control of your compliance and audits. Automate workflows, audit collection, compliance management, and all the boring security stuff. Learn about Compyl today at www.compyl.com.

Ransomware infects Discord, Twitter welcomes Trump, Black Friday scams

New ransomware encrypts files, then steals your Discord account Donald Trump returns to Twitter after Elon Musk's poll More than half of Black Friday spam emails are scams Thanks to today's episode sponsor, Compyl We all know that CISOs are overworked and stressed. CISOs made Compyl to reduce the noise, accelerate security maturity and let you and your team quickly make decisions that directly affect what's important to your business. Learn about Compyl at www.compyl.com. For the stories behind the headlines, head to CISOseries.com.

Week in Review: The fall of FTX, Australia Medibank fallout, supply chain failures

Link to Blog Post This week'sCyber Security Headlines Week in Review, November 14-18, is hosted byRich Stroffolinowith our guest,John Scrimsher, CISO,Kontoor Brands Thanks to today's episode sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms like SalesForce and Microsoft? What about the data these apps can access? After all, one compromised third party app could put your entire SaaS ecosystem at risk.With AppOmni, you get visibility to all third party apps, including which end users have enabled them, and the level of data access they've been granted. VisitAppOmni.comto request a free risk assessment....

Musk's ultimatum, Iran breaches government using Log4Shell, Amazon RDS data leak

Musk's ultimatum to employees leaves Twitter at risk Iranian APT breaches government agency using Log4Shell Hundreds of Amazon RDS snapshots discovered leaking user data And now a word from our sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms like Salseforce and Microsoft? What about the data these apps can access? After all, one compromised third party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps, including which end users have enabled them, and the level of data access they've been granted. Visit...

Disneyland phishing, Ukraine's IT army in action, NSA goes low-key with private researchers

Disneyland phishes with Punycode The effectiveness of Ukraine's IT army NSA seeks to lower barriers to work with private sector And now a word from our sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms like Salseforce and Microsoft? What about the data these apps can access? After all, one compromised third party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps, including which end users have enabled them, and the level of data access they've been granted. Visit AppOmni.com to request a...

Amazon cuts 10,000, FIFA apps warning, Breach impact 98%

Amazon to cut 10,000 employees in tech and corporate roles Privacy experts cautious about FIFA World Cup Apps 98% of organizations have been severely impacted by cyber supply chain breach And now a word from our sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms like Salseforce and Microsoft? What about the data these apps can access? After all, one compromised third party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps, including which end users have enabled them, and the level of...

Australia ransom ban, scourge of brand impersonation sites, GitHub gets private reporting

Australia considers ban on ransomware payments Thousands of sites used for brand impersonation GitHub gets private reporting And now a word from our sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms like Salseforce and Microsoft? What about the data these apps can access? After all, one compromised third party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps, including which end users have enabled them, and the level of data access they've been granted. Visit AppOmni.com to request a free risk assessment.

Android lockscreen bypass, Lockbit hits Thales, FTX funds disappear

Android phone owner accidentally finds a way to bypass lock screen Thales hit by Lockbit 3.0 again At least $1 billion of client funds missing at FTX And now a word from our sponsor, AppOmni Can you name all the third party apps connected to your major SaaS platforms like Salseforce and Microsoft? What about the data these apps can access? After all, one compromised third party app could put your entire SaaS ecosystem at risk. With AppOmni, you get visibility to all third party apps, including which end users have enabled them, and the level of data access they've...

Lockbit operator extradited, Twitter CISO quits, NotPetya insurance shakeup

Alleged LockBit operator to be extradited from Canada to U.S. Musk's ends remote work and promised to fight spam. CISO Kissner quits. Insurance giant settles NotPetya lawsuit, signaling cyber insurance shakeup And now a word from our sponsor, AppOmni Did you know that over half of companies have sensitive SaaS data exposed on the public internet? And many breaches making headlines now involve SaaS apps? AppOmni can help. AppOmni identifies misconfigurations and guides remediation to keep your SaaS data secure. We help Security teams make sense of data access permissions, third party app visibility, and threat detection across their entire...

Crypto Winter comes for FTX, oil and gas flow control vulnerability, images hide malware in PyPI

Crypto Winter comes for FTX Vulnerability found in oil and gas utilities Vulnerability found in oil and gas utilities And now a word from our sponsor, AppOmni Did you know that over half of companies have sensitive SaaS data exposed on the public internet? And many breaches making headlines now involve SaaS apps? AppOmni can help. AppOmni identifies misconfigurations and guides remediation to keep your SaaS data secure. We help Security teams make sense of data access permissions, third party app visibility, and threat detection across their entire SaaS ecosystem. Get started at AppOmni.com. For the stories behind the headlines,...

Powerball drawing delayed, Australian health record leak, Hushpuppi gets 11 year sentence

$2 billion Powerball drawing delayed by security issues Hackers leak Australian health records on dark web Hushpuppi gets 11 years in prison for cyber fraud And now a word from our sponsor, AppOmni Did you know that over half of companies have sensitive SaaS data exposed on the public internet? And many breaches making headlines now involve SaaS apps? AppOmni can help. AppOmni identifies misconfigurations and guides remediation to keep your SaaS data secure. We help Security teams make sense of data access permissions, third party app visibility, and threat detection across their entire SaaS ecosystem. Get started at AppOmni.com....

China stocking up vulnerabilities, DOJ seizes 50,000 bitcoin, DOJ takes down Z-Library

China stockpiling vulnerabilities US seizes Silk Road bitcoins DOJ takes down Z-Library And now a word from our sponsor, AppOmni Did you know that over half of companies have sensitive SaaS data exposed on the public internet? And many breaches making headlines now involve SaaS apps? AppOmni can help. AppOmni identifies misconfigurations and guides remediation to keep your SaaS data secure. We help Security teams make sense of data access permissions, third party app visibility, and threat detection across their entire SaaS ecosystem. Get started at AppOmni.com. For the stories behind the headlines, head to CISOseries.com.

Treasury thwarts Killnet, UK scanning devices, Denmark train cyberattack

US Treasury thwarts DDoS attack from Russian Killnet group British government scanning all Internet devices hosted in UK Denmark trains halted by cyberattack And now a word from our sponsor, AppOmni Did you know that over half of companies have sensitive SaaS data exposed on the public internet? And many breaches making headlines now involve SaaS apps? AppOmni can help. AppOmni identifies misconfigurations and guides remediation to keep your SaaS data secure. We help Security teams make sense of data access permissions, third party app visibility, and threat detection across their entire SaaS ecosystem. Get started at AppOmni.com. For the...

Week in Review: Thomson Reuters leak, LockBit dominates ransomware, Stripe cuts jobs

Link to Blog Post This week'sCyber Security Headlines Week in Review, October 31-November 4, is hosted byRich Stroffolinowith our guest,Marcos Marrero, CISO,H.I.G. Capital Thanks to today's episode sponsor, Votiro UFOs are everywhere. They're in your applications, cloud storage, endpoints, and emails. That's right UFOs UnidentifiedFileObjects are hiding in files across your organization. UFOs can contain malware that exfiltrates data or deploys ransomware. And 70% of UFOs can't be detected by traditional scanning solutions like Anti-Virus and Sandboxing. That's where Votiro comes in. Votiro prevents UFOs before they hitch a ride in on files without detection, and without slowing down business....

Boeing subsidiary incident, Stripe job cuts, news website malware

Cyber incident at Boeing subsidiary causes flight planning disruptions Stripe to lay off 14% of workforce Over 250 US news websites deliver malware via supply chain attack Thanks to today's episode sponsor, Votiro UFOs are everywhere. They're in your applications, cloud storage, endpoints, and emails. That's right UFOs Unidentified File Objects are hiding in files across your organization.UFOs can contain malware that exfiltrates data or deploys ransomware. And 70% of UFOs can't be detected by traditional scanning solutions like Anti-Virus and Sandboxing. That's where Votiro comes in. Votiro prevents UFOs before they hitch a ride in on files without detection,...

W4SP stings PyPI, password hubris, Dropbox breached

W4SP malware stings PyPI LastPass warns of security hubris Dropbox breached Thanks to today's episode sponsor, Votiro UFOs are everywhere.They're in your applications, cloud storage, endpoints, and emails.That's right UFOs Unidentified File Objects are hiding in files across your organization.UFOs can contain malware that exfiltrates data or deploys ransomware. And 70% of UFOs can't be detected by traditional scanning solutions like Anti-Virus and Sandboxing. That's where Votiro comes in. Votiro prevents UFOs before they hitch a ride in on files without detection, and without slowing down business. Do you believe? Learn more at Votiro.com/

LockBit dominates ransomware, CISA on voting integrity, ransomware reporting

LockBit dominates ransomware CISA on voting integrity A call for more ransomware reporting Thanks to today's episode sponsor, Votiro UFOs are everywhere.They're in your applications, cloud storage, endpoints, and emails.That's right UFOs Unidentified File Objects are hiding in files across your organization.UFOs can contain malware that exfiltrates data or deploys ransomware. And 70% of UFOs can't be detected by traditional scanning solutions like Anti-Virus and Sandboxing. That's where Votiro comes in. Votiro prevents UFOs before they hitch a ride in on files without detection, and without slowing down business. Do you believe? Learn more at Votiro.com/

Antivirus used to spread malware, White House ransomware summit, Ed tech company hit with FTC complaint

Threat group rides antivirus software to install malware White House organizes ransomware summit Ed tech company exposed user data Thanks to today's episode sponsor, Votiro UFOs are everywhere.They're in your applications, cloud storage, endpoints, and emails.That's right UFOs Unidentified File Objects are hiding in files across your organization.UFOs can contain malware that exfiltrates data or deploys ransomware. And 70% of UFOs can't be detected by traditional scanning solutions like Anti-Virus and Sandboxing. That's where Votiro comes in. Votiro prevents UFOs before they hitch a ride in on files without detection, and without slowing down business. Do you believe? Learn more...

Thomson Reuters leak, Polish Parliament cyberattack, trolls bombard Twitter

Thomson Reuters leaks 3TB of sensitive data Massive cyberattack hits Slovak and Polish Parliaments Twitter trolls bombard platform after Elon Musk takeover Thanks to today's episode sponsor, Votiro UFOs are everywhere. They're in your applications, cloud storage, endpoints, and emails. That's right UFOs Unidentified File Objects are hiding in files across your organization.UFOs can contain malware that exfiltrates data or deploys ransomware. And 70% of UFOs can't be detected by traditional scanning solutions like Anti-Virus and Sandboxing. That's where Votiro comes in. Votiro prevents UFOs before they hitch a ride in on files without detection, and without slowing down business....

Week in Review: Musk buys Twitter, Russia's satellite warning, Industrial ransomware attacks rise

Link to Blog Post This week'sCyber Security Headlines Week in Review, October 24-28, is hosted byRich Stroffolinowith our guest, Will Gregorian, former Senior Director, Technology Operations and Security, Rhino Thanks to this week's episode sponsor, Votiro UFOs are everywhere. They're in your applications, cloud storage, endpoints, and emails. That's right UFOs UnidentifiedFileObjects are hiding in files across your organization. UFOs can contain malware that exfiltrates data or deploys ransomware. And 70% of UFOs can't be detected by traditional scanning solutions like Anti-Virus and Sandboxing. That's where Votiro comes in. Votiro prevents UFOs before they hitch a ride in on files...

Russia's satellite warning, New York Post hacked, Fast Company breach

Russia warns West: We can target your commercial satellites New York Post says its site was hacked after posting offensive tweets White House announces 100-day cyber sprint for chemical sector Thanks to this week's episode sponsor, Votiro UFOs are everywhere.They're in your applications, cloud storage, endpoints, and emails. That's right UFOs Unidentified File Objects are hiding in files across your organization.UFOs can contain malware that exfiltrates data or deploys ransomware. And 70% of UFOs can't be detected by traditional scanning solutions like Anti-Virus and Sandboxing. That's where Votiro comes in. Votiro prevents UFOs before they hitch a ride in on...

Sigstore opens free service, Medibank hacked, 20-year old SQLite bug

Sigstore opens free software signing service Australian health insurer hacked Researcher details 20-year old SQLite bug Thanks to this week's episode sponsor, Votiro UFOs are everywhere.They're in your applications, cloud storage, endpoints, and emails. That's right UFOs Unidentified File Objects are hiding in files across your organization.UFOs can contain malware that exfiltrates data or deploys ransomware. And 70% of UFOs can't be detected by traditional scanning solutions like Anti-Virus and Sandboxing. That's where Votiro comes in. Votiro prevents UFOs before they hitch a ride in on files without detection, and without slowing down business. Do you believe? Learn more at...

See Tickets card breach, US charges Chinese agents, Tata Power's data leaked

See Tickets discloses 2.5 year-long credit card breach US charges Chinese agents in Huawei obstruction case Hive begins leaking Tata Power's data Thanks to this week's episode sponsor, Votiro UFOs are everywhere.They're in your applications, cloud storage, endpoints, and emails. That's right UFOs Unidentified File Objects are hiding in files across your organization.UFOs can contain malware that exfiltrates data or deploys ransomware. And 70% of UFOs can't be detected by traditional scanning solutions like Anti-Virus and Sandboxing. That's where Votiro comes in. Votiro prevents UFOs before they hitch a ride in on files without detection, and without slowing down business....

Daixin Team, PoCs host malware, Iranian nuclear agency hacked

CISA warns of Daixin Team Exploit POCs used to host malware Iranian nuclear agency hacked Thanks to this week's episode sponsor, Votiro UFOs are everywhere.They're in your applications, cloud storage, endpoints, and emails. That's right UFOs Unidentified File Objects are hiding in files across your organization.UFOs can contain malware that exfiltrates data or deploys ransomware. And 70% of UFOs can't be detected by traditional scanning solutions like Anti-Virus and Sandboxing. That's where Votiro comes in. Votiro prevents UFOs before they hitch a ride in on files without detection, and without slowing down business. Do you believe? Learn more at Votiro.com/UFOs

Windows JavaScript zero-day, Iran-based hack-and-leak, METRO retailer attack

Exploited Windows zero-day lets JavaScript files bypass Mark of the Web security warnings FBI warns of 'hack-and-leak' operations from group based in Iran Wholesale giant METRO confirmed to have suffered a cyberattack Thanks to this week's episode sponsor, Votiro UFOs are everywhere.They're in your applications, cloud storage, endpoints, and emails.That's right UFOs Unidentified File Objects are hiding in files across your organization.UFOs can contain malware that exfiltrates data or deploys ransomware. And 70% of UFOs can't be detected by traditional scanning solutions like Anti-Virus and Sandboxing.That's where Votiro comes in. Votiro prevents UFOs before they hitch a ride in on...

Week in Review: Dutch Police Trick DeadBolt, GenZ meh on Cybersecurity, Submarine cable severed

Link to Blog Post This week'sCyber Security Headlines Week in Review, October 17-21, is hosted byRich Stroffolinowith our guest,Lee Parrish, CISO,Newell Brands Thanks to this week's episode sponsor, SafeBase Security questionnaires are a pain, and sharing sensitive documents takes too much back and forth. As a result, security can be wrongly viewed as a roadblock rather than a sales enabler.That's whereSafeBasecomes in. Our Smart Trust Center makes it easy to showcase your security program, share sensitive documents, and streamline security reviews. It's the missing piece of your security and sales workflow, and the only security tool that gives you time...

Submarine cables severed, Microsoft's BlueBleed problem, Health system breach

Internet connectivity worldwide impacted by severed EU subsea cables Microsoft BlueBleed customer data leak claimed to be 'one of the largest' in years Health system data breach due to Meta Pixel hits 3 million patients Thanks to this week's episode sponsor, SafeBase Security questionnaires are a pain, and sharing sensitive documents takes too much back and forth. As a result, security can be wrongly viewed as a roadblock rather than a sales enabler.That's where SafeBase comes in. Our Smart Trust Center makes it easy to showcase your security program, share sensitive documents, and streamline security reviews. It's the missing piece...

Ransom Cartel linked to REvil, Gen Z security awareness, Open Compute Project's Caliptra

Ransom Cartel linked to REvil Do we need cybersecurity training for Gen Z? Open Compute Project announces Caliptra Thanks to this week's episode sponsor, SafeBase Security questionnaires. If those two words sent a shiver down your spine, you need to check out SafeBase.SafeBase's Smart Trust Center is a centralized source of truth for your organization's security and compliance information. After implementing SafeBase, many companies see a 90% reduction in custom questionnaires. Imagine how much time you'd save. Visit safebase.com to find out more.

Verizon customer accounts breached, German cyber chief removed, Fortinet vuln actively exploited

Verizon notifies customers their accounts were breached German cyber chief removed over alleged Russian ties Fortinet vulnerability being actively exploited Thanks to this week's episode sponsor, SafeBase Security questionnaires are a pain, and sharing sensitive documents takes too much back and forth. As a result, security can be wrongly viewed as a roadblock rather than a sales enabler.That's where SafeBase comes in. Our Smart Trust Center makes it easy to showcase your security program, share sensitive documents, and streamline security reviews. It's the missing piece of your security and sales workflow, and the only security tool that gives you time...

Ransomware hits German newspaper, Meta battles on content moderation report, and KakaoTalk goes down in Korea

Ransomware halts German newspaper circulation Meta disputes Indian content moderation report KakaoTalk called a "national communication network" in Korea Thanks to this week's episode sponsor, SafeBase Security questionnaires are a pain, and sharing sensitive documents takes too much back and forth. As a result, security can be wrongly viewed as a roadblock rather than a sales enabler.That's where SafeBase comes in. Our Smart Trust Center makes it easy to showcase your security program, share sensitive documents, and streamline security reviews. It's the missing piece of your security and sales workflow, and the only security tool that gives you time back....

Ukraine novel ransomware, Drones drop pineapple, Tata Power attacked

Microsoft says Ukraine, Poland targeted with novel ransomware attack Wi-Fi spy drones snoop on financial firm Indian power generation giant Tata Power hit by a cyber attack Thanks to this week's episode sponsor, SafeBase Security questionnaires. If those two words sent a shiver down your spine, you need to check out SafeBase.SafeBase's Smart Trust Center is a centralized source of truth for your organization's security and compliance information. After implementing SafeBase, many companies see a 90% reduction in custom questionnaires. Imagine how much time you'd save. Visit safebase.com to find out more. For the stories behind the headlines, head to...

Week in Review: CISOs' Uber scapegoating, US Airport DDoS, Digital license plates

Link to Blog Post This week'sCyber Security Headlines Week in Review, October 10-14, is hosted byRich Stroffolinowith our guest,Matt Honea, Head Of Security,SmartNews Thanks to today's episode sponsor, NoName Security Prevent API attacks in real-time with automated AI and ML-based detection fromNoname Security. Monitor API traffic for data leakage, data tampering, data policy violations, suspicious behavior, and API security attacks. Integrate with your existing IT workflow management system like Jira, ServiceNow, or Slack for seamless remediation. Learn more atnonamesecurity.com/runtime-protection All links and the video of this episode can be found on CISO Series.com

Polonium targets Israel, CISO-Board relationships, UK Supply chain

Polonium APT targets Israel with a new custom backdoor dubbed PapaCreep RSA Conference reveals CISO-Board relationships UK government urges action to enhance supply chain security Thanks to today's episode sponsor, Noname Security Prevent API attacks in real-time with automated AI and ML-based detection from Noname Security. Monitor API traffic for data leakage, data tampering, data policy violations, suspicious behavior, and API security attacks. Integrate with your existing IT workflow management system like Jira, ServiceNow, or Slack for seamless remediation. Learn more at nonamesecurity.com/runtime-protection For the stories behind the headlines, head to CISOseries.com.

Npm timing attack, legit software spreading malware, Mango Markets hacked for $100 million

Npm timing attack could impact supply chain Legit software used to spread malicious WhatsApp mod Mango Markets hit by $100 million hack Thanks to today's episode sponsor, Noname Security Are you sure your APIs are secure? Noname Security discovers all the APIs running on your network and analyzes them to spot design flaws, misconfigurations, and vulnerabilities. You can even catalog sensitive data and quickly see how many APIs are able to access credit card data, phone numbers, SSNs, and other sensitive PII data. Learn more at nonamesecurity.com/posture-management

UK warns of Chinese security threat, Toyota data leak, CISOs at risk of being overworked

UK warns of Chinese global security threat Toyota data leak impacts 300,000 customers CISOs at risk of being overworked Thanks to today's episode sponsor, Noname Security Stop API vulnerabilities before production with Noname Security. Automatically run over 100 dynamic tests that simulate malicious traffic, including the OWASP API Top Ten. Integrate with your existing CI/CD pipelines and tools, such as Jenkins and Postman, as well as all your ticketing and workflow tools such as ServiceNow, Slack, and Jira. Learn more at nonamesecurity.com/active-testing For the stories behind the headlines, head to CISOseries.com

Cyber Security Headlines: Heat leaks passwords, KillNet hits airports, Intel UEFI leak

Finger heat can leak your password US airport sites targeted by KillNet Intel confirms UEFI leak Thanks to today's episode sponsor, Noname Security Prevent API attacks in real-time with automated AI and ML-based detection from Noname Security. Monitor API traffic for data leakage, data tampering, data policy violations, suspicious behavior, and API security attacks. Integrate with your existing IT workflow management system like Jira, ServiceNow, or Slack for seamless remediation. Learn more at nonamesecurity.com/runtime-protection

Urgent Fortinet vulnerability, Windows update flaw, CISO scapegoating danger

Fortinet warns admins to patch critical auth bypass bug immediately Windows 11 22H2 errors break provisioning Security chiefs fear 'CISO scapegoating' following Uber-Sullivan verdict Thanks to today's episode sponsor, Noname Security Are you sure your APIs are secure? Noname Security discovers all the APIs running on your network and analyzes them to spot design flaws, misconfigurations, and vulnerabilities. You can even catalog sensitive data and quickly see how many APIs are able to access credit card data, phone numbers, SSNs, and other sensitive PII data. Learn more at nonamesecurity.com/posture-management For the stories behind the headlines, head to CISOseries.com.

Week in Review: Lazarus hits Dell, Uber chief guilty, Musk's Twitter Takeover

Link to Blog Post This week'sCyber Security Headlines Week in Review, October 3-7, is hosted bySean Kelly, with our guest,Patrick Benoit, VP, Global Cyber, GRC/BISO,CBRE Thanks to this week's episode sponsor, Hunters Hunters is a SaaS platform, purpose built for Security Operation teams. Providing unlimited data ingestion and normalization at a predictable cost, Hunters helps SOC teams mitigate real threats faster and more reliably than SIEM. VisitHunters.aito learn more. All links and the video of this episode can be found on CISO Series.com

Uber coverup ruling, Optus data spilled, Easylife's trigger fine

Former Uber security chief found guilty of data breach coverup Optus confirms 2.1 million ID numbers exposed in data breach Retailer Easylife fined 1.5m for data protection breaches Thanks to today's episode sponsor, Hunters Hunters is a SaaS platform, purpose built for Security Operation teams. Providing unlimited dataingestion and normalization at a predictable cost, Hunters helps SOC teams mitigate real threats faster and more reliably than SIEM. Visit Hunters.ai to learn more. For the stories behind the headlines, head to CISOseries.com.

CommonSpirit Health "IT security issue," MySQL backdoor, P2P payment fraud rises

CommonSpirit Health hit with "IT security issue" MySQL servers backdoored Fraud hitting P2P payment apps Thanks to today's episode sponsor, Hunters Hunters is a SaaS platform, purpose built for Security Operation teams. Providing unlimited dataingestion and normalization at a predictable cost, Hunters helps SOC teams mitigate real threats faster and more reliably than SIEM. Visit Hunters.ai to learn more.

Musk Twitter deal update, TikTok security deal politics, Netwalker affiliate sentenced

Musk offers to proceed with Twitter deal TikTok security deal becomes a political pawn Netwalker ransomware affiliate sentenced to 20 years in prison Thanks to today's episode sponsor, Hunters Hunters is a SaaS platform, purpose built for your Security Operation team. Cimpress, theparent company of VistaPrint, implemented Hunters SOC Platform to replace its SIEM. Thanks to Hunters, Cimpress no longer needs to babysit alerts and detection logic they've improved their SOC's efficiency, and optimized costs. Visit Hunters.ai to learn more. For the stories behind the headlines, visit CISOseries.com

LA School Data Leaked, Exchange mitigations bypassed, Supreme Court looks at Section 230

LA school data published on leak site Exchange zero-day mitigations bypassed Supreme Court will look legal protections for apps and sites Thanks to today's episode sponsor, Hunters Hunters helps your security team overcome data volume and complexity while significantlyreducing false positives. Upwork uses Hunters SOC Platform to "remain threat focused". Because of Hunters, Upwork has been able to stop going through the daily repetitive task of looking at alerts, and doing repetitive, manual investigations. Learn more at: Hunters.ai

Microsoft Zero days, Lazarus attacks Dell, NSA employee caught

Microsoft confirms two Exchange Server zero days are being used in cyberattacks Lazarus hackers abuse Dell driver bug using new FudModule rootkit Ex-NSA employee charged with violating Espionage Act, selling U.S. cyber secrets Thanks to today's episode sponsor, Hunters Hunters is a SaaS platform, purpose built for Security Operation teams. Providing unlimited dataingestion and normalization at a predictable cost, Hunters helps SOC teams mitigate real threats faster and more reliably than SIEM. Visit Hunters.ai to learn more. For the stories behind the headlines, head to CISOseries.com.

Week in Review: Uber hacker arrested, cyberattacks deluge organizations, Lazarus hacks Macs

Link to Blog Post This week'sCyber Security Headlines Week in Review, September 26-30, is hosted byRich Stroffolinowith our guest,Sara Lazarus, VP and head of trust and security,Stavvy Thanks to today's episode sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more atVotiro.com. All links and the video of this episode can be...

Russia's cyber winter, military contractor attack, IRS smishing warning

Finnish intelligence warns Russia 'highly likely' to turn to cyber in winter Researchers uncover covert attack campaign targeting military contractors IRS warns of "industrial scale" smishing surge Thanks to today's episode sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com. For the stories behind the headlines, head to CISOseries.com.

Leaked ransomware used in attack, Cloudflare Turnstile, Fast Company hit with cyber attack

Leaked ransomware builder used in attacks Cloudflare hopes Turnstile can replace CAPTCHAs Fast Company goes dark after cyber attack Thanks to today's episode sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com.

Lazarus targets macOS, Geopolitical DDoS, Meta takes down influence networks

Lazarus Group targets macOS users Geopolitics behind recent DDoS surge Meta takes on influence networks Thanks to today's episode sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com.

Jamf buys ZecOps, porn phishing DDoS, Cloudflare Zero Trust SIM

Jamf buys ZecOps Porn phishing scam turns into a DDoS Cloudflare announced secure eSIM offering Thanks to today's episode sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com.

Uber hacker arrested, Microsoft SQL hacked, CircleCI GitHub hack

London Police arrest 17-year-old hacker suspected of Uber and GTA 6 breaches Microsoft SQL servers hacked in TargetCompany ransomware attacks Attackers impersonate CircleCI platform to compromise GitHub accounts Thanks to today's episode sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com. For the stories behind the headlines, head to...

Week in Review: Uber and Twitter hacks, MFA exploits, Ransomware in decline?

Link to Blog Post This week'sCyber Security Headlines Week in Review, September 19-23, is hosted byRich Stroffolinowith our guest,Joseph Lewis, Director, Cyber Assessment Strategy,US Department of Energy Thanks to this week's sponsor, 6clicks 6clicksis your AI-powered GRC platform, featuring a fully integrated content library. 6clicks provides organizations with a powerful GRC platform to build highly scalable risk and compliance functions and advisors with the tools to streamline and scale their services, saving everyone enormous time and money. Reimagine risk. Improve cybersecurity. Demonstrate compliance. For more information visit6clicks.com/cisoseries. All links and the video of this episode can be found on CISO...

MFA fatigue hacking, Senate blasts counterintelligence, Australian telco breach

MFA Fatigue: Hackers' new favorite tactic in high-profile breaches Senate reports details inefficiencies, confusion at key U.S. counterintelligence center Australian telco Optus suffers massive data breach Thanks to today's episode sponsor, 6clicks With 6clicks, organizations can manage enterprise risk easier than ever before. 6clicks helps you identify your risks, group them into risk registers, and run risk assessments. It highlights causes and potential impacts, outlines risk treatment plans, and helps you manage the full treatment lifecycle all while informing your holistic GRC posture with built-in data linkages. For more information visit 6clicks.com/cisoseries. For the stories behind the headlines, head to...

15-year old Python bug, LinkedIn Smart Link phishing, US military using Augury

15-year old Python bug causing problem LinkedIn Smart Links used for phishing US military buys Augury network monitoring tool Thanks to today's episode sponsor, 6clicks Your GRC solution is only as valuable as the reports it can generate. Provide an exceptional analytics experience for all your GRC stakeholders with the 6clicks reporting suite. Unlock powerful insights and prove compliance using dashboards and charts, pixel perfect reporting, presentations, and data storytelling via LiveDocs.. For more information visit 6clicks.com/cisoseries.

American Airlines hack, $160M swiped from Wintermute, 2K and Rockstar cyberattacks

American Airlines announce breach of customer and staff info Crypto market maker hacked for $160 million 2K and Rockstar fall victim to cyber attacks Thanks to today's episode sponsor, 6clicks The 6clicks GRC solution comes with a fully integrated content library full of hundreds of standards, assessment templates, libraries, playbooks, and more. With the content library included in every 6clicks license, organizations can get started on their GRC implementation faster than ever before. For more information visit 6clicks.com/cisoseries. For the stories behind the headlines, head to CISOseries.com

Chromeloader evolves, ransomware falls, US reviews social media campaigns

The shifting ways of Chromeloader Ransomware attacks fall in first half Pentagon orders review of social media influence campaigns Thanks to today's episode sponsor, 6clicks Experience the magic of Hailey, the 6clicks artificial intelligence engine for risk and compliance. With Hailey, organizations can automatically show cross-compliance between regulations or identify gaps to external compliance requirements in their policies. Eliminate manual and costly risk and compliance processes by joining the hundreds of businesses that trust 6clicks. For more information visit 6clicks.com/cisoseries.

Uber downplays breach, LastPass downplays hack, Netgear router vulnerability

Uber says there is no evidence that users' private information was compromised LastPass says hackers accessed its systems for just 4 days Netgear Routers impacted by FunJSQ module flaw Thanks to today's episode sponsor, 6clicks 6clicks has pioneered a unique Hub & Spoke architecture to underpin its AI-powered GRC solution and cater to markets requiring scalable, multi-tenanted GRC. This model enables organizations to deploy multiple, autonomous GRC entities connected to a single hub for roll-up reporting, management, and visibility. For more information visit 6clicks.com/cisoseries. For the stories behind the headlines, head to CISOseries.com.

Week in Review: Uber hacked, intermittent encryption ransomware, Twitter overheats

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,Quincy Castro, CISO,Redis Thanks to today's episode sponsor, Edgescan Scalable automated and continuous Attack Surface Management (ASM) and vulnerability detection integrated with a world-class cyber security team provide 100% false-positive-free alerts and expert remediation guidance.Edgescan.com All links and the video of this episode can be found on CISO Series.com

Gamers targeted on YouTube, Biden supply chain order, Queen Elizabeth II phishing scam

Gamers targeted by self-spreading stealer on YouTube Biden order further scrutinizes foreign tech supply chains Phishing attacks being launched in the name of Queen Elizabeth II Thanks to today's episode sponsor, Edgescan Edgescan simplifies Vulnerability Management by delivering a single full-stack solution (SaaS) integrated with world-class security professionals. Instead of managing a plethora of point scanning tools for each layer of the attack surface and squandering precious staff resources manually removing false positives, Edgescan offers automated and accurate contextualized alerts across the entire attack surface into a single source of truth. For the stories behind the headlines, head to CISOseries.com

Teams leaks tokens, cyberscammer human trafficking, Treasury Tornado Cash guidance

Teams stores tokens in cleartext Cyberscammers caught up in human trafficking US Treasury issues guidance on Tornado Cash Thanks to today's episode sponsor, Edgescan Scalable automated and continuous Attack Surface Management (ASM) and vulnerability detection integrated with a world-class cyber security team provide 100% false-positive-free alerts and expert remediation guidance.

Apple's second zero-day, heat beats tweets, herd mentality phishing

Apple Releases iOS and macOS updates to patch actively exploited zero-day flaw Extreme California heat knocks key Twitter data center offline New phishing scheme uses 'herd mentality' approach to dupe victims Thanks to today's episode sponsor, Edgescan Edgescan combines full-stack coverage with integrated reporting and business-level prioritization to deliver a single source of truth for your entire vulnerability management program with zero false positives. For the stories behind the headlines, head to CISOseries.com.

Google buys Mandiant, Redbleed mitigations hurt, Meta hands over PyTorch

Google closes on Mandiant Paying the iron price for Retbleed mitigation Meta hands over the keys to PyTorch Thanks to today's episode sponsor, Edgescan Edgescan offers a single platform solution that covers the full stack, from Web Applications to APIs to the Network and data layer. Continuous Attack Surface Management coupled with automated & strategic Pen-testing as a Service (PTaaS) yields fully scalable coverage.

Intermittent encryption warning, HP firmware bugs, SEC crypto office

Ransomware gangs switching to new intermittent encryption tactic Firmware bugs in many HP computer models left unfixed for over a year U.S. SEC to set up new office for crypto filings Thanks to today's episode sponsor, Edgescan Edgescan simplifies Vulnerability Management by delivering a single full-stack solution (SaaS) integrated with world-class security professionals. Instead of managing a plethora of point scanning tools for each layer of the attack surface and squandering precious staff resources manually removing false positives, Edgescan offers automated and accurate contextualized alerts across the entire attack surface into a single source of truth. For the stories behind...

Week in Review: TikTok breach, China accuses US, CISA feedback

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,Jason Elrod, CISO,Multicare Health System Thanks to today's episode sponsor, Snyk Developers want to code fast and security wants to ship securely and they want to do it all from the cloud. That's why they both chooseSnyk. Backed by industry-leading security intelligence, Snyk provides real-time scanning with automated fixes and remediation advice right from the tools and workflows developers use. Code, dependencies, containers, cloud environments all of it. And while developers are building securely,Snykgives security teams a bird's eye view of all...

China accuses US, London buses hacked, New APT42 group

China accuses US of cyberattacks and cyberespionage London's biggest bus operator hit by cyber "incident" Researchers reveal new Iranian threat group APT42 Thanks to today's episode sponsor, Snyk Developers want to code fast and security wants to ship securely and they want to do it all from the cloud. That's why they both choose Snyk. Backed by industry-leading security intelligence, Snyk provides real-time scanning with automated fixes and remediation advice right from the tools and workflows developers use. Code, dependencies, containers, cloud environments... all of it. And while developers are building securely, Snyk gives security teams a bird's eye view...

CISA incident reporting, Linux-focused IoT malware, Albania cuts ties over cyberattack

CISA asks for feedback on reporting rules New Linux-focused malware targets IoT Albania cuts diplomatic ties over cyberattack Thanks to today's episode sponsor, Snyk Developers want to code fast and security wants to ship securely and they want to do it all from the cloud. That's why they both choose Snyk. Backed by industry-leading security intelligence, Snyk provides real-time scanning with automated fixes and remediation advice right from the tools and workflows developers use. Code, dependencies, containers, cloud environments... all of it. And while developers are building securely, Snyk gives security teams a bird's eye view of all of their...

Ex-Uber exec heads to trial, Twitter fires back at Mudge, FBI K-12 warning

Uber's ex-cyber exec heads to trial Twitter fires back at Mudge for "parroting" Elon Musk FBI warns of ransomware attacks on school districts Thanks to today's episode sponsor, Snyk Developers want to code fast and security wants to ship securely and they want to do it all from the cloud. That's why they both choose Snyk. Backed by industry-leading security intelligence, Snyk provides real-time scanning with automated fixes and remediation advice right from the tools and workflows developers use. Code, dependencies, containers, cloud environments... all of it. And while developers are building securely, Snyk gives security teams a bird's eye...

Sextortion ring busted, TikTok denies breach, Cloudflare cuts off Kiwi Farms

Transnational sextortion ring dismantled TikTok denies breachtok Cloudflare cuts off Kiwi Farms Thanks to today's episode sponsor, Snyk Developers want to code fast and security wants to ship securely and they want to do it all from the cloud. That's why they both choose Snyk. Backed by industry-leading security intelligence, Snyk provides real-time scanning with automated fixes and remediation advice right from the tools and workflows developers use. Code, dependencies, containers, cloud environments... all of it. And while developers are building securely, Snyk gives security teams a bird's eye view of all of their projects and cloud environments, so they...

Fed agency supply chain tips, Apple lawsuit settlement, Neopets 18 month hack

Federal agencies share supply chain security tips Apple settles lawsuit with developer over App Store rejections and scams Hackers were inside Neopets systems for 18 months Thanks to today's episode sponsor, Code42 It's not just about the data leaving your company - what about the data coming in? Along with departing employees, new talent is also actively joining your organization. This poses cybersecurity challenges since they could be knowingly or unknowingly bringing data from their former company into your network. Code42 Incydr is an Insider Risk Management SaaS that provides a comprehensive understanding of your data exposure and shows which...

Google's open-source bug bounty, Ragnar Locker hits airline, Cloudflare won't cut off services

Google launches open-source bug bounty Ragnar Locker claims attack on airline Cloudflare won't terminate services for controversial customers Thanks to today's episode sponsor, Code42 Surprise! Surprise! Five years from now, Jamie, who's resigning today, will ring the NASDAQ bell officially launching her company on the public market. And what you'll soon realize is that Jamie stole your most valuable data to start her new company. Learn how Code42 Incydr can stop data theft and protect your organizations' most valuable assets. Visit Code42.com/showme to learn more.

Google Translate malware, White House aviation briefing, book distributor ransomed

Google Translate app is actually Windows crypto-mining malware White House to give aviation executives classified cyberthreat briefing Book distributor Baker & Taylor hit by ransomware Thanks to our episode sponsor, Code42 Cybersecurity teams are facing unprecedented challenges when it comes to protecting sensitive corporate data from exposure, leak and theft. In fact, the Code42 Annual Data Exposure Report revealed there's a 1 in 3 chance that your company will lose IP when an employee quits. To learn more about stopping data leaks with Insider Risk Management visit Code42.com/showme. For the stories behind the headlines, head to CISOseries.com.

Log4Shell Hits Israel, Russian cyberattacks on Montenegro, AlphaBay Turns 1

Microsoft warns Iranians using Log4Shell Montenegro hit with Russian cyberattacks AlphaBay Turns 1 Thanks to this week's episode sponsor, Code42 Have you been thinking about launching an Insider Risk Management program? You don't need to be Big Brother to effectively address Insider Risk. Code42 believes that the Three Es should define any IRM program: expertise, education, and enforcement. Shift your security culture from "watchdog" to "guide dog" and everyone wins. Learn more at Code42.com/showme.

Hackers breach LastPass, new Agenda ransomware, Facebook Cambridge settlement

Hackers breach LastPass developer system to steal source code New Agenda ransomware appears in the threat landscape Facebook-Cambridge Analytica data breach lawsuit ends in 11th hour settlement Thanks to this week's episode sponsor, Code42 It's not just about the data leaving your company - what about the data coming in? Along with departing employees, new talent is also actively joining your organization. This poses cybersecurity challenges since they could be knowingly or unknowingly bringing data from their former company into your network. Code42 Incydr is an Insider Risk Management SaaS that provides a comprehensive understanding of your data exposure and...

Week in Review: Satellite hacks, Insurers balk, Twitter's cybersecurity

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,John McClure, CISO,Sinclair Broadcast Group Thanks to today's episode sponsor, Code42 It's not just about the data leaving your company what about the data coming in? Along with departing employees, new talent is also actively joining your organization. This poses cybersecurity challenges since they could be knowingly or unknowingly bringing data from their former company into your network. Code42 Incydris an Insider Risk Management SaaS that provides a comprehensive understanding of your data exposure and shows which activities require security intervention. Learn...

North Korea at BlackHat, Ransomware attacks jump, Pentagon software requirements

North Korean malware present at Black Hat Ransomware attacks jump as new malware strains proliferate Pentagon may require flaw-free software Thanks to today's episode sponsor, Code42 It's not just about the data leaving your company - what about the data coming in? Along with departing employees, new talent is also actively joining your organization. This poses cybersecurity challenges since they could be knowingly or unknowingly bringing data from their former company into your network. Code42 Incydr is an Insider Risk Management SaaS that provides a comprehensive understanding of your data exposure and shows which activities require security intervention. Learn more...

Nobelium's MagicWeb, pro-Western influence campaigns, $100 million in NFTs stolen

Microsoft reveals Nobelium's MagicWeb Details emerge on large-scale pro-Western influence campaigns Stolen NFTs prove big business Thanks to today's episode sponsor, Code42 Surprise! Surprise! Five years from now, Jamie, who's resigning today, will ring the NASDAQ bell officially launching her company on the public market. And what you'll soon realize is that Jamie stole your most valuable data to start her new company. Learn how Code42 Incydr can stop data theft and protect your organizations' most valuable assets. Visit Code42.com/showme to learn more.

Twitter ex-security chief whistleblower, Ukraine and Poland join forces, Binance deepfake scam

Ex-security chief accuses Twitter of cybersecurity negligence Ukraine and Poland join forces to counter Russian cyberattacks Hackers use Binance exec deepfake in crypto exchange scam Thanks to today's episode sponsor, Code42 Cybersecurity teams are facing unprecedented challenges when it comes to protecting sensitive corporate data from exposure, leak and theft. In fact, the Code42 Annual Data Exposure Report revealed there's a 1 in 3 chance that your company will lose IP when an employee quits. To learn more about stopping data leaks with Insider Risk Management visit Code42.com/showme. For the stories behind the headlines, head over to CISOseries.com

State-backed attacks not insured, LockBit hit with DDoS, Cozy Bear gets around MFA

State-backed attacks excluded from cyber insurance LockBit hit with DDoS Cozy Bear using Microsoft accounts to bypass MFA Thanks to today's episode sponsor, Code42 Have you been thinking about launching an Insider Risk Management program? You don't need to be Big Brother to effectively address Insider Risk. Code42 believes that the Three Es should define any IRM program: expertise, education, and enforcement. Shift your security culture from "watchdog" to "guide dog" and everyone wins. Learn more at Code42.com/showme.

Urgent iPhone update, ZIP password fault, Hacking decommissioned satellites

iPhone users urged to update to patch 2 zero-days Encrypted ZIP files can have two correct passwords White hat hackers broadcast through decommissioned satellite Thanks to today's episode sponsor, Code42 It's not just about the data leaving your company - what about the data coming in? Along with departing employees, new talent is also actively joining your organization. This poses cybersecurity challenges since they could be knowingly or unknowingly bringing data from their former company into your network. Code42 Incydr is an Insider Risk Management SaaS that provides a comprehensive understanding of your data exposure and shows which activities require...

Week in Review: Ukraine at Black Hat, Starlink hacked, cybersecurity workforce inequity

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,Stephen Harrison, VP Cyber Defense,MGM Resorts Thanks to today's episode sponsor, 6clicks With6clicks, organizations can manage enterprise risk easier than ever before. 6clicks helps you identify your risks, group them into risk registers, and run risk assessments. It highlights causes and potential impacts, outlines risk treatment plans, and helps you manage the full treatment lifecycle. For more information visit6clicks.com/cisoseries. All links and the video of this episode can be found on CISO Series.com

Google blocks DDoS, Moore leaves Cyber Command, BlackByte's ransomware options

Google blocks largest HTTPS DDoS attack 'reported to date' Cyber Command loses Moore A new version of BlackByte offers extortion options Thanks to today's episode sponsor, 6clicks With 6clicks, organizations can manage enterprise risk easier than ever before. 6clicks helps you identify your risks, group them into risk registers, and run risk assessments. It highlights causes and potential impacts, outlines risk treatment plans, and helps you manage the full treatment lifecycle. For more information visit 6clicks.com/cisoseries. For the stories behind the headlines, head to CISOseries.com.

PyPi backdoors, Project Sugarush, Redalpha phishing

PyPi packages turn installed apps to backdoors Project Sugarush targets Israeli shipping RedAlpha ramps up phishing efforts Thanks to today's episode sponsor, 6clicks Manage the full assessment lifecycle and get your business audit-ready more easily than ever using 6clicks. Identify overlap from completed audits and assessments with other standards and frameworks using Hailey-AI to streamline compliance with multiple audit requirements. With built-in content, organizations can get started on their audit and assessments faster than ever before. For more information visit 6clicks.com/cisoseries.

Oracle audits Tik Tok, Digital Ocean dumps Mailchimp, Twilio targets Signal

Oracle begins auditing TikTok's algorithms Digital Ocean dumps Mailchimp after attack leaked customer data Signal users exposed in targeted Twilio attack Thanks to today's episode sponsor, 6clicks 6clicks is where vulnerability management and GRC unite. With 6licks, organizations can ingest their vulnerabilities from all scanners, link assets to vulnerabilities, raise risks and issues to remediate, and close vulnerabilities as they are remediated all while informing their risk and compliance posture in a single platform for cohesive reporting. For more information visit 6clicks.com/cisoseries. For the stories behind the headlines, head to CISOseries.com.

Chat app backdoor, PyPi cryptominer, corporate access prices drop

Chat app used as a backdoor PyPi package drops crytominer Access to corporate networks sees a value dip Thanks to today's episode sponsor, 6clicks Protect your supply chain from third-party risk with the power of 6clicks. Organizations can better manage their vendor risk by automating the vendor assessment lifecycle and detecting vendor assessment findings. Users can identify and raise risks linked to vendors post-assessment and group them into risk registers. Then, manage, remediate and report on risks directly from 6clicks. For more information visit 6clicks.com/cisoseries.

Ukraine cyber chief at Black Hat, Lockheed Martin breach?, $25 Starklink hack

Ukraine's cyber chief makes surprise visit to Black Hat Killnet claims to have hacked Lockheed Martin Starlink successfully hacked using $25 modchip Thanks to today's episode sponsor, 6clicks Identify, track, respond, and remediate issues and incidents from your various GRC workflows with 6clicks. With an issue submission form, 6clicks makes it easy and efficient for employees to submit incidents directly to an incident management team for triaging and response. Use the built-in incident response playbooks, or your own, to standardize incident response across the organization. For more information visit 6clicks.com/cisoseries. For the stories behind the headlines, head to CISOseries.com

Week in Review: Emergency Alert flaws, Twilio confirms hack, Rebuild CISA - Krebs

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,Jack Kufahl, CISO,Michigan Medicine Thanks to today's episode sponsor, Edgescan Edgescansimplifies Vulnerability Management by delivering a single full-stack solution (SaaS) integrated with world-class security professionals. Instead of managing a plethora of point scanning tools for each layer of the attack surface and squandering precious staff resources manually removing false positives, Edgescan offers automated and accurate contextualized alerts across the entire attack surface into a single source of truth. All links and the video of this episode can be found on CISO Series.com

Cisco's Lapsus$ breach, Rebuild CISA Krebs, ransomware BEC epidemic

Cisco admits corporate network compromised by gang with links to Lapsus$ CISA should split from DHS says Chris Krebs Ransomware data theft epidemic fueling BEC attacks Thanks to today's episode sponsor, Edgescan Edgescan simplifies Vulnerability Management by delivering a single full-stack solution (SaaS) integrated with world-class security professionals. Instead of managing a plethora of point scanning tools for each layer of the attack surface and squandering precious staff resources manually removing false positives, Edgescan offers automated and accurate contextualized alerts across the entire attack surface into a single source of truth. For the stories behind the headlines, head to CISOseries.com.

Open Cybersecurity Schema Framework launches, Intel SGX flaw, CISA adds DogWalk to patch list

Introducing the Open Cybersecurity Schema Framework New flaw found in Intel SGX CISA adds to its Known Exploited Vulnerabilities database Thanks to today's episode sponsor, Edgescan Scalable automated and continuous Attack Surface Management (ASM) and vulnerability detection integrated with a world-class cyber security team provide 100% false-positive-free alerts and expert remediation guidance.

Chinese kids defrauded, Twitter Saudi spy, Facebook data divulged

Chinese fraudsters target kids playing online games Former Twitter employee convicted in Saudi spy case Facebook divulges data leading to abortion prosecution Thanks to today's episode sponsor, Edgescan Edgescan combines full-stack coverage with integrated reporting and business-level prioritization to deliver a single source of truth for your entire vulnerability management program with zero false positives. For the stories behind the headlines, head to CISOseries.com

Treasury sanctions Tornado Cash, Twilio confirms hack, Chinese hacking group targets backdoors

Treasury sanctions Tornado Cash Twilio confirms hack Chinese hacking group targets backdoors Thanks to today's episode sponsor, Edgescan Edgescan offers a single platform solution that covers the full stack, from Web Applications to APIs to the Network and data layer. Continuous Attack Surface Management coupled with automated & strategic Pen-testing as a Service (PTaaS) yields fully scalable coverage.

Emergency Alert flaws, Kaspersky VPN bug, Pick Fick quick

Critical flaws found in US Emergency Alert System Security experts urge Fick's speedy confirmation as first U.S. cyber ambassador High-severity bug in Kaspersky VPN client opens door to PC takeover Thanks to today's episode sponsor, Edgescan Edgescan simplifies Vulnerability Management by delivering a single full-stack solution (SaaS) integrated with world-class security professionals. Instead of managing a plethora of point scanning tools for each layer of the attack surface and squandering precious staff resources manually removing false positives, Edgescan offers automated and accurate contextualized alerts across the entire attack surface into a single source of truth. For the stories behind the...

Week in Review: Cyberattacks hit Taiwan, Missile manufacturer hit, Class action donuts

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,Yael Nagler,CISO,Walker & Dunlop Thanks to this week's sponsor, HYAS "Did you know a cybersecurity breach doesn't have to mean that your business is shut down or your data is stolen? Malware, ransomware, data exfiltration: They all report to a command and control infrastructure to receive instructions. HYAS's unrivaled understanding of adversary infrastructure empowers you to cut off threats from their command and control, along with any related infrastructure. Like that old roach motel, hackers can get in, but they can't communicate...

Cyberattacks hit Taiwan, Cisco router flaws, DoJ prefers paper

Cyberattacks hit Taiwan to coincide with Speaker Pelosi's visit4 Cisco addresses critical flaws in Small Business VPN routers DOJ now relies on paper for its most sensitive court documents, official says Thanks to today's episode sponsor, HYAS We know IT and security teams are already overloaded facing constant pressure to improve security without additional resources. That's why it's so important to find solutions that bolster your security, not your workload. HYAS Protect deploys in under 30 minutes, easily integrates into existing infrastructure, constantly updates with the latest threat intelligence, renders attacks inert (regardless of how they infiltrated your environment), and...

Ukraine takes down bot farm, Solana wallets drained, Semikron cyberattack

Ukraine takes down massive bot farm Thousands of Solana wallets drained Semikron hit by cyberattack Thanks to today's episode sponsor, HYAS Cybercriminals try their hardest to cover their tracks, but no matter what, they always leave a trail. HYAS Insight gives you access to all of the data you need to trace an attack back to its source. This helps you map out the complete attack campaign infrastructure, letting you proactively defend against future attacks and even potentially provide key data to law enforcement. Take your cybersecurity investigations further than you ever thought possible with HYAS Insight. Visit HYAS.com

$190M crypto theft, T-Mobile store owner busted, EU missile maker extorsion

US crypto firm hit by $190 million theft T-Mobile store owner busted running phone unlocking scheme EU missile maker denies breach but confirms extortion attempt Thanks to today's episode sponsor, HYAS Cybercriminals try their hardest to cover their tracks, but no matter what, they always leave a trail. HYAS Insight gives you access to all of the data you need to trace an attack back to its source. This helps you map out the complete attack campaign infrastructure, letting you proactively defend against future attacks and even potentially provide key data to law enforcement. Take your cybersecurity investigations further than...

Akamai distrubs massive DDoS, Australian faces spyware charges, Meta struggles with Kenya hate speech

Akamai disrupts record DDoS in Europe Australian man faces spyware charges Meta accused of failing to tackle hate speech in Kenya Thanks to today's episode sponsor, HYAS Cybercriminals try their hardest to cover their tracks, but no matter what, they always leave a trail. HYAS Insight gives you access to all of the data you need to trace an attack back to its source. This helps you map out the complete attack campaign infrastructure, letting you proactively defend against future attacks and even potentially provide key data to law enforcement. Take your cybersecurity investigations further than you ever thought possible...

Fake investment network, DawDropper Android malware, North Korea's SharpTongue

Huge network of 11,000 fake investment sites targets Europe DawDropper Android apps serve up banking malware North Korea-linked SharpTongue spies on email accounts with a malicious browser extension Thanks to today's episode sponsor, Hyas. Better production environment security starts with visibility. After all, how can you protect your most valuable asset if you don't know A: what's expected and B: when something's happening that isn't expected? This is why HYAS Confront monitors traffic to alert you to anomalies, letting you address risks, threats, and changes, while blocking infiltrations before they become successful attacks. Don't just react, take your security back...

Week in Review: Chinese, Huawei misdeeds, Poor cybersecurity training, Data breach costs

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,Deneen DeFiore, VP, CISO,United Airlines Thanks to our show sponsor, Snyk Developers want to code fast and security wants to ship securely. And that's why they both chooseSnyk. Backed by industry-leading security intelligence, Snyk provides real-time scanning with automated fixes and remediation advice right from the tools and workflows developers use. Code, dependencies, containers, cloud infrastructure all of it. And while developers are building securely, Snyk gives security teams a bird's eye view of all of their projects, so they can prioritize...

Hackers dodge macros, 365 down again, 22M health record breach

Hackers opting for new attack methods after Microsoft blocked macros by default Microsoft 365 outage knocks down admin center in North America 22 million US health records breached thus far in 2022 Thanks to today's episode sponsor, Snyk Developers want to code fast and security wants to ship securely. And that's why they both choose Snyk. Backed by industry-leading security intelligence, Snyk provides real-time scanning with automated fixes and remediation advice right from the tools and workflows developers use. Code, dependencies, containers, cloud infrastructure... all of it. And while developers are building securely, Snyk gives security teams a bird's eye...

Subzero malware, JusTalk logs leak, average data breach cost

Microsoft warns of Subzero malware JusTalk logs leak The cost of an average data breach Thanks to today's episode sponsor, Snyk Developers want to code fast and security wants to ship securely. And that's why they both choose Snyk. Backed by industry-leading security intelligence, Snyk provides real-time scanning with automated fixes and remediation advice right from the tools and workflows developers use. Code, dependencies, containers, cloud infrastructure... all of it. And while developers are building securely, Snyk gives security teams a bird's eye view of all of their projects, so they can prioritize and focus their efforts in the right...

$6 million music platform hack, Rogers coding error, increased North-Korean bounty

Hacker swipes $6 million from blockchain music platform Coding error to blame for Rogers outage US doubles reward for tips on North Korean-backed hackers Thanks to today's episode sponsor, Snyk Developers want to code fast and security wants to ship securely. And that's why they both choose Snyk. Backed by industry-leading security intelligence, Snyk provides real-time scanning with automated fixes and remediation advice right from the tools and workflows developers use. Code, dependencies, containers, cloud infrastructure... all of it. And while developers are building securely, Snyk gives security teams a bird's eye view of all of their projects, so they...

LockBit hits Italy, Quantum bill heads to Senate, Windows adds brute force defense

LockBit hits Italy Quantum cybersecurity bill heads to the Senate Windows adds brute force defense Thanks to today's episode sponsor, Snyk Developers want to code fast and security wants to ship securely. And that's why they both choose Snyk. Backed by industry-leading security intelligence, Snyk provides real-time scanning with automated fixes and remediation advice right from the tools and workflows developers use. Code, dependencies, containers, cloud infrastructure... all of it. And while developers are building securely, Snyk gives security teams a bird's eye view of all of their projects, so they can prioritize and focus their efforts in the right...

FBI nabs Huawei, Android leaks Twitterers, Microsoft's printer warning

FBI uncovers Chinese and Huawei misdeeds 5.4 million Twitter accounts available for sale Microsoft warns that new Windows updates may break printing Thanks to today's episode sponsor, Snyk Developers want to code fast and security wants to ship securely. And that's why they both choose Snyk. Backed by industry-leading security intelligence, Snyk provides real-time scanning with automated fixes and remediation advice right from the tools and workflows developers use. Code, dependencies, containers, cloud infrastructure... all of it. And while developers are building securely, Snyk gives security teams a bird's eye view of all of their projects, so they can prioritize...

Week in Review: Hiring slows, new infrastructure woes, Tik Tok grows

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,Renee Guttmann, Former CISO, Campbell Soup, Coca Cola, Time Warner Thanks to this week's sponsor, 6clicks 6clicksis your AI-powered GRC platform, featuring a fully-integrated content library. 6clicks provides organizations with a powerful GRC platform to build highly scalable risk and compliance functions and advisors with the tools to streamline and scale their services, saving everyone enormous time and money. Reimagine risk. Improve cybersecurity. Demonstrate compliance. For more information visit6clicks.com/cisoseries. All links and the video of this episode can be found on CISO...

Microsoft Teams outage, heatwave melts Oracle, hiring cyber mercenaries

Microsoft Teams outage also takes down Microsoft 365 services Heatwave forced Google and Oracle to shut down in London Hackers for hire: adversaries employ "cyber mercenaries" Thanks to today's episode sponsor, 6clicks Experience the magic of Hailey, the 6clicks artificial intelligence engine for risk and compliance. With Hailey, organizations can automatically show cross-compliance between regulations or identify gaps to external compliance requirements in their policies. Eliminate manual and costly risk and compliance processes by joining the hundreds of businesses that trust 6clicks. For more information visit 6clicks.com/cisoseries. For the stories behind the headlines, head to CISOseries.com.

Microsoft security job cuts, Neopet data leak, Russia malware trickery

Microsoft cuts security jobs amidst weakening economy Is your cute little Neopet leaking your personal data? Russia disguises malware as Ukrainian app for hacking Russia Thanks to today's episode sponsor, 6clicks The 6clicks GRC solution comes with a fully integrated content library full of hundreds of standards, assessment templates, libraries, playbooks, and more. With the content library included in every 6clicks license, organizations can get started on their GRC implementation faster than ever before. For more information visit 6clicks.com/content. For the stories behind the headlines, head over to CISOseries.com

Leaky GPS Trackers, Russian Malware Spoof Pro-Ukraine App, MacOS Backdoor to the Cloud

Car GPS tracker exposes location data Russian malware groups spoof pro-Ukraine apps MacOS backdoor speaks to the cloud Thanks to today's episode sponsor, 6clicks Your GRC solution is only as valuable as the reports it can generate. Provide an exceptional analytics experience for all your GRC stakeholders with the 6clicks reporting suite. Unlock powerful insights and prove compliance using dashboards and charts, pixel perfect reporting, presentations, and data storytelling via LiveDocs. For more information visit 6clicks.com/analytics/overview.

Cyberattack hits Albania, Speculative execution not patched, DARPA studies open-source

Albania hit with cyberattack Vendors not patching for speculative execution DARPA looks into open-source Thanks to today's episode sponsor, 6clicks 6clicks has pioneered a unique Hub & Spoke architecture to underpin its AI-powered GRC solution and cater to markets requiring scalable, multi-tenanted GRC. This model enables organizations to deploy multiple, autonomous GRC entities connected to a single hub for roll-up reporting, management, and visibility. For more information visit 6clicks.com/lp-enterprise-hub-spoke.

Towns paying for remote workers, CISA orders agency patch, PLC software delivers Sality

Dozens of cities and towns are paying tech workers to abandon Silicon Valley CISA orders agencies to patch new Windows zero-day used in attacks Password recovery tool infects industrial systems with Sality malware Thanks to today's episode sponsor, 6clicks The 6clicks AI-powered GRC platform with an integrated content library is the most intelligent way to get ISO 27001 certified. It allows you to automate audits, manage risks, track assets, and report in real-time. Join hundreds of businesses that trust 6clicks and start your ISO 27001 journey today. For more information visit 6clicks.com/lp-iso-27001. For the stories behind the headlines, head to...

Week in Review: Microsoft phishing warning, Callback phishing scams, Log4J forever

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,Carla Sweeney, VP Information SecurityRed Ventures Thanks to our episode sponsor, Edgescan Edgescansimplifies Vulnerability Management by delivering a single full-stack solution (SaaS) integrated with world-class security professionals. Instead of managing a plethora of point scanning tools for each layer of the attack surface and squandering precious staff resources manually removing false positives,Edgescanoffers automated and accurate contextualized alerts across the entire attack surface into a single source of truth. All links and the video of this episode can be found on CISO Series.com

C.I.A. Vault 7 engineer convicted, Hackers targeted Jan6 journalists, Twitter's brief outage

Ex-C.I.A. engineer convicted in biggest theft ever of Agency secrets Chinese hackers targeted U.S. political reporters just ahead of January 6 attack, researchers say Twitter outage briefly hits thousands Thanks to today's episode sponsor, Edgescan Edgescan simplifies Vulnerability Management by delivering a single full-stack solution (SaaS) integrated with world-class security professionals. Instead of managing a plethora of point scanning tools for each layer of the attack surface and squandering precious staff resources manually removing false positives, Edgescan offers automated and accurate contextualized alerts across the entire attack surface into a single source of truth. For the stories behind the headlines,...

Massive phishing operation, Android malware gets millions of millions, Spectre-like x86 attack

Microsoft warns of massive phishing operation Android malware downloaded over 3 million times More speculative-execution attacks found for x86 Thanks to today's episode sponsor, Edgescan Scalable automated and continuous Attack Surface Management (ASM) and vulnerability detection integrated with a world-class cyber security team provide 100% false-positive-free alerts and expert remediation guidance.

FTC anonymization crackdown, TikTok privacy change, gov't contractor pays $9 million

FTC is cracking down on false claims of anonymizing data TikTok halts privacy policy change in Europe Government contractor pays $9 million over whistleblower allegations Thanks to today's episode sponsor, Edgescan Edgescan combines full-stack coverage with integrated reporting and business-level prioritization to deliver a single source of truth for your entire vulnerability management program with zero false positives. For the stories behind the headlines, head to CISOseries.com

Ransomware hits French telco, NSO Group acquisition called off, Krebs on Experian security

Ransomware hits French telco NSO Group acquisition called off Krebs on Experian security Thanks to today's episode sponsor, Edgescan Edgescan offers a single platform solution that covers the full stack, from Web Applications to APIs to the Network and data layer. Continuous Attack Surface Management coupled with automated & strategic Pen-testing as a Service (PTaaS) yields fully scalable coverage.

China censors 1B hack, Pentagon's bug bounty, Tech hiring cools

China tries to censor what could be biggest data hack in history Pentagon: We'll pay you if you can find a way to hack us Tech's red-hot hiring spree shows signs of cooling Thanks to today's episode sponsor, Edgescan Edgescan simplifies Vulnerability Management by delivering a single full-stack solution (SaaS) integrated with world-class security professionals. Instead of managing a plethora of point scanning tools for each layer of the attack surface and squandering precious staff resources manually removing false positives, Edgescan offers automated and accurate contextualized alerts across the entire attack surface into a single source of truth. For the...

Week in Review July 4-8, 202

Link to Blog Post Cyber Security Headlines Week in Review July 4-8, 2022 This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,David Cross, SVP/CISOOracle SaaS Cloud Thanks to today's episode sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? WithVotiroyou can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more atVotiro.com. All links and the video of this...

July 8, 2022

Cisco and Fortinet release security patches for multiple products Canada's RCMP have been using powerful malware to snoop on people's communications Online programming IDEs can be used to launch remote cyberattacks Thanks to today's episode sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com. For the stories behind the...

July 7, 2022

Attackers moving off Cobalt Strike Cyberattacks against law enforcement on the rise Apple announces lockdown mode Thanks to today's episode sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com.

July 6, 2022

Hacker may have stolen personal data of 1 billion Chinese citizens Ukrainian police take down phishing gang behind payments scam NIST unveils 'quantum-proof' cryptography algorithms Thanks to today's episode sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com. For the stories behind the headlines, head to CISOseries.com

July 5, 2022

Jenkins discloses dozens of zero-day bugs in multiple plugins Rogue HackerOne employee steals bug reports to sell on the side Patchable and preventable security issues lead causes of Q1 attacks Thanks to today's episode sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com. For the stories behind the headlines,...

July 1, 2022

A new sophisticated malware is attacking SOHO routers New study shows over half of employees use prohibited apps Google battles bots, puts Workspace admins on alert Thanks to today's episode sponsor, Optiv The modern enterprise needs a solution as unique as its business. Optiv's Advanced Detection and Response (ADR) works with your organization to comb through the D&R clutter and find the ideal security solutions for your business. ADR delivers tailored detection and response backed by technology, real-time intel and deep expertise applied at touch. Bottom line: ADR finds and neutralizes threats fast, so you can focus on what matters....

June 30, 2022

NATO to create rapid response cyber force FBI warns of deep fakes for remote work Ship controls identified as another major attack surface Thanks to today's episode sponsor, Optiv The modern enterprise needs a solution as unique as its business. Optiv's Advanced Detection and Response (ADR) works with your organization to comb through the D&R clutter and find the ideal security solutions for your business. ADR delivers tailored detection and response backed by technology, real-time intel and deep expertise applied at touch. Bottom line: ADR finds and neutralizes threats fast, so you can focus on what matters. If you'd like...

June 29, 2022

Stolen PII and deepfakes used to apply for tech jobs Russia fines foreign firms for data violations Premier League crypto sponsorships expose fans to big losses Thanks to today's episode sponsor, Optiv The modern enterprise needs a solution as unique as its business. Optiv's Advanced Detection and Response (ADR) works with your organization to comb through the D&R clutter and find the ideal security solutions for your business. ADR delivers tailored detection and response backed by technology, real-time intel and deep expertise applied at touch. Bottom line: ADR finds and neutralizes threats fast, so you can focus on what matters....

June 28, 2022

Ransomware gang launches bug bounty KillNet claims DDoS on Lithuania ICS security bill passes House Thanks to today's episode sponsor, Optiv The modern enterprise needs a solution as unique as its business. Optiv's Advanced Detection and Response (ADR) works with your organization to comb through the D&R clutter and find the ideal security solutions for your business. ADR delivers tailored detection and response backed by technology, real-time intel and deep expertise applied at touch. Bottom line: ADR finds and neutralizes threats fast, so you can focus on what matters. If you'd like to learn more about Optiv ADR, please visit...

June 27, 2022

New phishing method bypasses MFA using Microsoft WebView2 apps Russian threat actors may be behind the explosion at Texas liquefied natural gas plant Google reveals sophisticated Italian spyware campaign targeting victims in Italy, Kazakhstan Thanks to today's episode sponsor, Optiv The modern enterprise needs a solution as unique as its business. Optiv's Advanced Detection and Response (ADR) works with your organization to comb through the D&R clutter and find the ideal security solutions for your business. ADR delivers tailored detection and response backed by technology, real-time intel and deep expertise applied at touch. Bottom line: ADR finds and neutralizes threats...

Week in Review June 20-24, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,Marnie Wilking, CISO,Wayfair Thanks to today's episode sponsor, Optiv Modernizing your identity control plane from AD to the cloud is complex. Ralph Martino, who is leading the identity and access management (IAM) group forOptiv, discusses what challenges CISOs are facing in today's ever-changing climate: Increasing security Decreasing risk Lowering cost Learn more atwww.optiv.com/IAM-Microsoft. All links and the video of this episode can be found on CISO Series.com

June 24, 2022

Cloud email threats soar 101% in a year NHS warns of scam COVID-19 text messages Fancy Bear uses nuke threat lure to exploit 1-click bug Thanks to today's episode sponsor, Optiv Modernizing your identity control plane from AD to the cloud is complex. Ralph Martino, who is leading the identity and access management (IAM) group for Optiv, discusses what challenges CISOs are facing in today's ever-changing climate: Increasing security Decreasing risk Lowering cost Learn more at www.optiv.com/IAM-Microsoft. For the stories behind the headlines, head to CISOseries.com.

June 23, 2022

Daycare apps found insecure Encryption flaws found in Mega Microsoft retires cloud facial recognition Thanks to today's episode sponsor, Optiv Modernizing your identity control plane from AD to the cloud is complex. Ralph Martino, who is leading the identity and access management (IAM) group for Optiv, discusses what challenges CISOs are facing in today's ever-changing climate: Increasing security Decreasing risk Lowering cost Learn more at www.optiv.com/IAM-Microsoft.

June 22, 2022

Cloudflare outage impacts crypto exchanges Biden signs a pair of cybersecurity bills 7-zip now supports Windows 'Mark-of-the-Web' security feature Thanks to today's episode sponsor, Optiv Modernizing your identity control plane from AD to the cloud is complex. Ralph Martino, who is leading the identity and access management (IAM) group for Optiv, discusses what challenges CISOs are facing in today's ever-changing climate: Increasing security Decreasing risk Lowering cost Learn more at www.optiv.com/IAM-Microsoft. For the stories behind the headlines, head to CISOseries.com

June 21, 2022

Windows downloads blocked in Russia The importance of receipts Chrome extensions can be used for fingerprinting Thanks to today's episode sponsor, Optiv Modernizing your identity control plane from AD to the cloud is complex. Ralph Martino, who is leading the identity and access management (IAM) group for Optiv, discusses what challenges CISOs are facing in today's ever-changing climate: Increasing security Decreasing risk Lowering cost Learn more at www.optiv.com/IAM-Microsoft.

June 20, 2022

US DoJ announces shut down of Russian RSOCKS Botnet Experts warn of a new eCh0raix ransomware campaign targeting QNAP NAS Mixed results for Russia's aggressive Ukraine information war, experts say Thanks to today's episode sponsor, Optiv Modernizing your identity control plane from AD to the cloud is complex. Ralph Martino, who is leading the identity and access management (IAM) group for Optiv, discusses what challenges CISOs are facing in today's ever-changing climate: Increasing security Decreasing risk Lowering cost Learn more at www.optiv.com/IAM-Microsoft. For the stories behind the headlines, head to CISOseries.com.

Week in Review June 13-17, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,Ariel Weintraub, CISO,MassMutual Thanks to today's episode sponsor, Datadog Check outDatadog's on-demand fireside chat with CTO Cormac Brady. Over the course of his 20+ year career at Thomson Reuters, Cormac consistently built bridges between technical teamsand in the process helped teams achieve superior results and earned himself senior leadership positions. Watch now atdatadoghq.com/ciso/ All links and the video of this episode can be found on CISO Series.com

June 17, 2022

House Armed Services chair calls national security software, systems 'too vulnerable' Microsoft Office 365 AutoSave can assist cloud ransomware attacks OMIGOD! There's more to OMIGOD Thanks to today's episode sponsor, Datadog Watch Datadog's on-demand webinar for a 30-minute discussion on driving DevSecOps best practices in the enterprise with CTO Cormac Brady. Over the course of his 20+ year career at Thomson Reuters, Cormac consistently built bridges between technical teamsand in the process helped teams achieve superior results and earned himself senior leadership positions. Cormac shares stories and leadership lessons that are applicable to any enterprise technical leader looking to help...

June 16, 2022

Cloudflare repels another record DDoS Africa's largest supermarket chain hit with ransomware Resurgence in travel not ignored by threat actors Thanks to today's episode sponsor, Datadog Check out Datadog's on-demand fireside chat with CTO Cormac Brady. Over the course of his 20+ year career at Thomson Reuters, Cormac consistently built bridges between technical teamsand in the process helped teams achieve superior results and earned himself senior leadership positions. Watch now at datadoghq.com/ciso/

June 15, 2022

US defense contractor discusses takeover of NSO spyware DoJ will no longer prosecute ethical hackers Attack on Kaiser Permanente exposes data of thousands of customers Thanks to today's episode sponsor, Datadog Watch Datadog's on-demand webinar for a 30-minute discussion on driving DevSecOps best practices in the enterprise with CTO Cormac Brady. Over the course of his 20+ year career at Thomson Reuters, Cormac consistently built bridges between technical teamsand in the process helped teams achieve superior results and earned himself senior leadership positions. Cormac shares stories and leadership lessons that are applicable to any enterprise technical leader looking to help...

June 14, 2022

Leaky continuous integration logs Exchange servers used to deploy Black Cat Bluetooth can be used to track phones Thanks to today's episode sponsor, Datadog Check out Datadog's on-demand fireside chat with CTO Cormac Brady. Over the course of his 20+ year career at Thomson Reuters, Cormac consistently built bridges between technical teamsand in the process helped teams achieve superior results and earned himself senior leadership positions. Watch now at datadoghq.com/ciso/

June 13, 2022

Amazon's chat app has a child sex abuse problem Ransomware decryptors now for sale on gaming platform China's biggest online influencers go dark Thanks to today's episode sponsor, Datadog Watch Datadog's on-demand webinar for a 30-minute discussion on driving DevSecOps best practices in the enterprise with CTO Cormac Brady. Over the course of his 20+ year career at Thomson Reuters, Cormac consistently built bridges between technical teamsand in the process helped teams achieve superior results and earned himself senior leadership positions. Cormac shares stories and leadership lessons that are applicable to any enterprise technical leader looking to help their firm...

Week in Review June 6-10, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 6-10, is hosted byRich Stroffolinowith our guest,Upendra Mardikar, CSO,Snap Finance Thanks to our sponsor, PlexTrac PlexTracis the platform that empowers your offensive security team to spend more time hacking and less time reporting. Build better reports in half the time, centralize your data, maximize your reusable content, and become more efficient and effective. PlexTrac clients report a "5X ROI in 1 year," a "30% increase in efficiency," have "cut their reporting cycle by 65%," and experienced a "18 to 22% time savings per engagement." Check outPlexTrac.com/CISOSeriesto learn how...

June 10, 2022

MFA could be long haul for some federal agencies says CISA official New Emotet variant stealing users' credit card information from Google Chrome Symantec: More malware operators moving in to exploit Follina Thanks to today's episode sponsor, PlexTrac PlexTrac is the platform that empowers your offensive security team to spend more time hacking and less time reporting. Build better reports in half the time, centralize your data, maximize your reusable content, and become more efficient and effective. PlexTrac clients report a "5X ROI in 1 year," a "30% increase in efficiency," have "cut their reporting cycle by 65%," and experienced...

June 9, 2022

Lack of reporting hurting the ransomware fight CISA warns of China-linked network snooping Personal information marketplace taken down Thanks to today's episode sponsor, PlexTrac PlexTrac is the platform that empowers your offensive security team to spend more time hacking and less time reporting. Build better reports in half the time, centralize your data, maximize your reusable content, and become more efficient and effective. PlexTrac clients report a "5X ROI in 1 year," a "30% increase in efficiency," have "cut their reporting cycle by 65%," and experienced a "18 to 22% time savings per engagement." Check out PlexTrac.com/CISOSeries to learn how...

June 8, 2022

Passwords are finally dead Hackers steal credit cards from online gun shops Shields data breach affects 2 million patients Thanks to today's episode sponsor, PlexTrac The best penetration tests begin and end with PlexTrac. PlexTrac can improve efficiency and effectiveness at every phase of your proactive assessments. By centralizing the data from all your automation tools, cataloging important reusable content for easy access, and promoting communication and visibility at every phase of an assessment, PlexTrac cuts reporting time in half and adds value between reports. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the premier pentest reporting and management platform....

June 7, 2022

The once and future AlphaBay Karakurt adopts bill collector tactics China concludes its cybersecurity review of Didi Thanks to today's episode sponsor, PlexTrac PlexTrac is the platform that empowers your offensive security team to spend more time hacking and less time reporting. Build better reports in half the time, centralize your data, maximize your reusable content, and become more efficient and effective. PlexTrac clients report a "5X ROI in 1 year," a "30% increase in efficiency," have "cut their reporting cycle by 65%," and experienced a "18 to 22% time savings per engagement." Check out PlexTrac.com/CISOSeries to learn how PlexTrac...

June 6, 2022

Evasive phishing mixes reverse tunnels and URL shortening services Exploit released for Atlassian Confluence RCE bug, patch now Lawmakers are racing to pass tech antitrust reforms before midterms Thanks to today's episode sponsor, PlexTrac The best penetration tests begin and end with PlexTrac. PlexTrac can improve efficiency and effectiveness at every phase of your proactive assessments. By centralizing the data from all your automation tools, cataloging important reusable content for easy access, and promoting communication and visibility at every phase of an assessment, PlexTrac cuts reporting time in half and adds value between reports. Check out PlexTrac.com/CISOSeries to learn why...

Week in Review May 30-June 3, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, May 30-June 3, is hosted byRich Stroffolinowith our guest,Steve Zalewski, Co-host,Defense in Depth Thanks to today's episode sponsor, Feroot All links and the video of this episode can be found on CISO Series.com

June 3, 2022

Leaked Conti chats confirm gang's ability to conduct firmware-based attacks Critical UNISOC chip vulnerability affects millions of Android smartphones ExpressVPN removes servers in India after refusing to comply with government order Thanks to today's episode sponsor, Feroot Feroot secures client-side web applications so that businesses can deliver a flawless and safe digital user experience to their customers. Inspector and Pageguard, Feroot's automated data protection solutions, increase code visibility, facilitate threat analysis, and detect and protect from dangerous client-side attacks, such as Magecart, cross-site scripting, e-skimming, and other threats focused on front-end JavaScript and web applications. Learn more at www.feroot.com. For...

June 2, 2022

Europol shuts down FluBot Hive ransomware kicks Costa Rica when its down CISA issues advisory on voting machine vulnerabilities Thanks to today's episode sponsor, Feroot Feroot secures client-side web applications so that businesses can deliver a flawless and safe digital user experience to their customers. Inspector and Pageguard, Feroot's automated data protection solutions, increase code visibility, facilitate threat analysis, and detect and protect from dangerous client-side attacks, such as Magecart, cross-site scripting, e-skimming, and other threats focused on front-end JavaScript and web applications. Learn more at www.feroot.com.

June 1, 2022

Follina vulnerability under active exploitation Tension inside Google over conduct of fired researcher IBM to pay $1.6 billion for poaching customer account Thanks to today's episode sponsor, Feroot Feroot secures client-side web applications so that businesses can deliver a flawless and safe digital user experience to their customers. Inspector and Pageguard, Feroot's automated data protection solutions, increase code visibility, facilitate threat analysis, and detect and protect from dangerous client-side attacks, such as Magecart, cross-site scripting, e-skimming, and other threats focused on front-end JavaScript and web applications. Learn more at www.feroot.com. For the stories behind the headlines, head to CISOseries.com

May 31, 2022

China censoring open-source code Follina zero-day hits Office EnemyBot botnet acts fast Thanks to today's episode sponsor, Feroot Feroot secures client-side web applications so that businesses can deliver a flawless and safe digital user experience to their customers. Inspector and Pageguard, Feroot's automated data protection solutions, increase code visibility, facilitate threat analysis, and detect and protect from dangerous client-side attacks, such as Magecart, cross-site scripting, e-skimming, and other threats focused on front-end JavaScript and web applications. Learn more at www.feroot.com.

May 30, 2022

Pro-Russian hacker group KillNet plans to attack Italy today Microsoft warns that hackers are using more advanced techniques to steal credit card data China makes offer to ten nations help to run their cyber-defenses Thanks to today's episode sponsor, Feroot Feroot secures client-side web applications so that businesses can deliver a flawless and safe digital user experience to their customers. Inspector and Pageguard, Feroot's automated data protection solutions, increase code visibility, facilitate threat analysis, and detect and protect from dangerous client-side attacks, such as Magecart, cross-site scripting, e-skimming, and other threats focused on front-end JavaScript and web applications. Learn more...

May 27, 2022

Up to 83% of known compromised passwords would satisfy regulatory requirements Broadcom confirms deal to acquire VMware Experts warn of rise in ChromeLoader malware Thanks to today's episode sponsor, Optiv Up for a Zero Trust Crash Course? Join our expert, Jerry Chapman, Engineering Fellow at Optiv and author of "Zero Trust Security: An Enterprise Guide," as he delivers the following takeaways: - An introduction to Zero Trust - An overview of Optiv's Zero Trust principles - How to visualize your Zero Trust journey and place it in the proper context Catch Jerry's Zero Trust crash course or learn more by...

May 26, 2022

Popular open source libraries leaked keys for "research" DuckDuckGo gives Microsoft a pass on trackers Microsoft weathers the vulnerability storm Thanks to today's episode sponsor, Optiv Need a guide on your Zero Trust journey? Jerry Chapman, Engineering Fellow at Optiv and author of "Zero Trust Security: An Enterprise Guide" shares the following takeaways: - The key elements of Zero Trust - How to visualize your Zero Trust journey and place it in the proper context - Integrated technologies to drive adaptive processes and a mature security model Learn more at www.optiv.com/zerotrust.

May 25, 2022

Interpol warns nation-state malware could become a commodity on dark web soon General Motors Hit by cyber-attack exposing car owners' personal info Canada to ban China's Huawei and ZTE from its 5G networks Thanks to today's episode sponsor, Optiv Up for a Zero Trust Crash Course? Join our expert, Jerry Chapman, Engineering Fellow at Optiv and author of "Zero Trust Security: An Enterprise Guide," as he delivers the following takeaways: - An introduction to Zero Trust - An overview of Optiv's Zero Trust principles - How to visualize your Zero Trust journey and place it in the proper context Catch...

May 24, 2022

Cyberattack divorces Zola users from registries A look at the RansomHouse data-extortion operation Now we have to worry about pre-hijacking attacks Thanks to today's episode sponsor, Optiv Need a guide on your Zero Trust journey? Jerry Chapman, Engineering Fellow at Optiv and author of "Zero Trust Security: An Enterprise Guide" shares the following takeaways: - The key elements of Zero Trust - How to visualize your Zero Trust journey and place it in the proper context - Integrated technologies to drive adaptive processes and a mature security model Learn more at www.optiv.com/zerotrust. For the stories behind the headlines, go to...

May 23, 2022

Ransomware victim trolls hackers with obscene pics CISOs list top cyber threats to enterprises in 2022 YouTube removes more than 9,000 Ukraine war-related channels Thanks to today's episode sponsor, Optiv Need a guide on your Zero Trust journey? Jerry Chapman, Engineering Fellow at Optiv and author of "Zero Trust Security: An Enterprise Guide" shares the following takeaways: - The key elements of Zero Trust - How to visualize your Zero Trust journey and place it in the proper context - Integrated technologies to drive adaptive processes and a mature security model Learn more at www.optiv.com/zerotrust. For the stories behind the...

Week in Review May 16-20, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, May 16-20, is hosted byRich Stroffolinowith our guest,Jerich Beason, CISO, Commercial Bank,CapitalOne Thanks to today's episode sponsor, Torq All links and the video of this episode can be found on CISO Series.com

May 20, 2022

Greenland health services limited from cyberattacks Phishing attacks surge in Q1 Google details 2021 zero-days And now let's thank today's sponsor, Torq Myth 5: You Should Automate All Security Processes False. You should automate routine, repetitive tasks that are not subject to much conditional variance. But workflows that can't be reliably managed by automation tools, such as assessing the financial consequences of a breach or determining whether a security incident should trigger an application rollback, should remain the domain of humans. To learn more about the realities of automation, head to torq.io.

May 19, 2022

VMware bugs abused to deliver Mirai malware Microsoft to debut of zero trust GDAP tool Bank of Zambia refuses to pay ransom to cyberattack group Hive And now let's thank today's sponsor, Torq Myth 4: Automation Will Replace Skilled Security Professionals Not true. Any business that attempts to automate security will quickly find that most high-stakes security issues are far too complex to be detected and remediated by automation tools alone. Human security professionals need to take the lead delivering nuanced insight about the business impact of a large-scale breach. To learn more about the realities of automation, head to...

May 18, 2022

Buffalo massacre suspect signaled plans on Discord for months Google faces litigation for unauthorised use of medical records Venezuelan doctor accused of developing and distributing ransomware And now let's thank today's sponsor, Torq Myth 3: Only Enterprises Need Security Automation Debunked. While enterprises with thousands of endpoints and sprawling teams certainly need automation, businesses of all sizes face challenges related to other forms of scale when it comes to security. For instance, there are about 1 billion known types of malware in existence, and they imperil businesses of all sizes equally. To learn more about the realities of automation, head...

May 17, 2022

Costa Rican ransomware rhetoric somehow gets uglier DOJ files its first criminal cryptocurrency sanctions case Trying to fix open source supply chain security And now let's thank today's sponsor, Torq Myth 2: Security Automation Is Just a New Term for Automated Security Testing Wrong. While scanning and testing may be one example of a security automation use case, it's hardly the only one. Automation can be used to do things like help manage complex security workflows and optimize collaboration between different stakeholders. These are tasks that were not traditionally automated. To learn more about the realities of automation, head to...

May 16, 2022

Ukraine CERT-UA warns of new attacks launched by Russia-linked Armageddon APT Microsoft fixes new PetitPotam Windows NTLM relay attack vector Hackers are exploiting critical bug in Zyxel firewalls and VPNs And now let's thank today's sponsor, Torq Myth 1: Automation Is Only a Reactive Part of SecOps Incorrect. Proactive management of security incidents is just as important, like automatically scanning IaC configurations to detect vulnerabilities, automating collaboration between devs, IT ops and SecOps to prevent risks before they're threats. To learn more about the realities of automation, head to torq.io. For the stories behind the headlines, head to CISOseries.com.

Week in Review May 9-13, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, May 9-13, is hosted byRich Stroffolinowith our guest,Rich Lindberg, CISO, JAMS Thanks to our sponsor, Datadog Break down silos between DevOps and Security teams to enable collaboration and strengthen the security of your environment. In this on-demand webinar, hear from one ofDatadog's engineers on how teams can speed up investigations by assessing security and observability data using Datadog's unified platform to reduce security threats by detecting vulnerabilities. Watch the on-demand webinar now to learn how to get full-stack security for your production environment atdatadoghq.com/ciso/ All links and the video...

May 13, 2022

Google will use mobile devices to thwart phishing attacks CISA urges organizations to patch actively exploited F5 BIG-IP vulnerability Kick China off social media, says tech governance expert Thanks to our episode sponsor, Datadog Break down silos between DevOps and Security teams to enable collaboration and strengthen the security of your environment. In this on-demand webinar, hear from one of Datadog's engineers on how teams can speed up investigations by assessing security and observability data using Datadog's unified platform to reduce security threats by detecting vulnerabilities. Watch the on-demand webinar now to learn how to get full-stack security for your...

May 12, 2022

Old botnets are new again Meta withdraws Oversight Board guidance request EU proposes new CSAM rules Thanks to our episode sponsor, Datadog In this on-demand webinar, you'll learn how to best utilize the suite of Datadog Cloud Security products to identify the root cause of an attack and how a unified platform provides real-time threat-detection and continuous configuration audits across applications, hosts, containers and cloud infrastructure. Built on top of the observability platform, Datadog brings unprecedented integration between security and devops aligned to shared organizational goals. Watch the on-demand webinar now to learn how to get full-stack security for your...

May 11, 2022

Russian TV hacked on Victory Day US pledges to help Ukraine keep internet and lights running Pentagon's concerns China may prompt vetting startups Thanks to our episode sponsor, Datadog In this on-demand webinar, you'll learn how to best utilize the suite of Datadog Cloud Security products to identify the root cause of an attack and how a unified platform provides real-time threat-detection and continuous configuration audits across applications, hosts, containers and cloud infrastructure. Built on top of the observability platform, Datadog brings unprecedented integration between security and devops aligned to shared organizational goals. Watch the on-demand webinar now to learn...

May 10, 2022

Ransomware state of emergency in Costa Rica Microsoft launches service to fill the cyber skills gap College closes permanently due to ransomware Thanks to our episode sponsor, Datadog Break down silos between DevOps and Security teams to enable collaboration and strengthen the security of your environment. In this on-demand webinar, hear from one of Datadog's engineers on how teams can speed up investigations by assessing security and observability data using Datadog's unified platform to reduce security threats by detecting vulnerabilities. Watch the on-demand webinar now to learn how to get full-stack security for your production environment at datadoghq.com/ciso/

May 9, 2022

Google Play now blocks paid app downloads, updates in Russia NIST releases updated guidance for defending against supply-chain attacks US State Department offering $10 million reward for information about Conti members Thanks to our episode sponsor, Datadog In this on-demand webinar, you'll learn how to best utilize the suite of Datadog Cloud Security products to identify the root cause of an attack and how a unified platform provides real-time threat-detection and continuous configuration audits across applications, hosts, containers and cloud infrastructure. Built on top of the observability platform, Datadog brings unprecedented integration between security and devops aligned to shared organizational...

Week in Review May 2-6, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, May 2-6, is hosted byRich Stroffolinowith our guest,Shawn Bowen, CISO,World Fuel Services Thanks to our episode sponsor, Censys WhyCensys? Our Attack Surface Management tool is designed from the ground up to seamlessly integrate with existing security workflows. It's the only ASM tool that discovers modern cloud specific assets like storage buckets and our scanning platform finds more than 85% more services than our nearest competitor. Start with Censys atcensys.io. All links and the video of this episode can be found on CISO Series.com

May 6, 2022

Decade-old bugs discovered in Avast, AVG antivirus software Thailand and Hong Kong Banks used most in BEC Every ISP in the US must block these 3 pirate streaming services Thanks to today's episode sponsor, Censys Why Censys? Our Attack Surface Management tool is designed from the ground up to seamlessly integrate with existing security workflows. It's the only ASM tool that discovers modern cloud specific assets like storage buckets and our scanning platform finds more than 85% more services than our nearest competitor. Start with Censys at censys.io. For the stories behind the headlines, head to CISOseries.com.

May 5, 2022

CuckooBees campaign stings targets for years Health and Human Services hammered over security Docker images used to DDoS Russian sites Thanks to today's episode sponsor, Censys Censys' Attack Surface Management tool discovers and inventories all Internet-facing assets including traditional assets like hosts, IPs, and cloud services like storage buckets across all accounts and networks. ASM gives you a continuous picture of your attack surface. Start with Censys at censys.io.

May 4, 2022

Google claims to have blocked billions of malicious app downloads NortonLifeLock willfully infringed malware patents Former eBay exec pleads guilty to cyber stalking Thanks to today's episode sponsor, Censys Tom the CTO can't go into the boardroom unprepared. It's his job to know all the risks to his company especially the one that could land him on the front page of the newspaper. His best bet for survival is staying ahead of the most critical threats. Tom, you can be that source of truth; start with Censys at censys.io right now. For the stories behind the headlines, head to CISOseries.com

May 3, 2022

Solana network goes dark after bot swarm The spyware in Spain falls mostly on the politicians Security isn't top of mind for mental health apps Thanks to today's episode sponsor, Censys All Pat the Security Practitioner wants is to do a good job and be the frontline in keeping his company safe. He's got great tools, but nothing that can show him if there are company assets that have somehow made their way onto the internet. If only Pat knew about Censys' Attack Surface Management tool. Now you do start with Censys at censys.io.

May 2, 2022

Top 15 exploited security vulnerabilities in 2021 India gives orgs 6 hours to report cyber incidents The White House wants more powers to crack down on rogue drones Thanks to today's episode sponsor, Censys What Chris the CISO wants is to protect against revenue loss and damage to his company's brand from data breaches and compliance failures. But he's got a blind spot around his internet exposure. What assets are out there on the internet that his team doesn't know about? Well, Chris, it's simple start with Censys at censys.io. For the stories behind the headlines, visitCISOseries.com.

Week in Review Apr 25-29, 2022

Link to Blog Post This week's Cyber Security Headlines - Week in Review, Apr 25-29, is hosted by Rich Stroffolino with our guest, Hadas Cassorla, CISO, M1 Financial Thanks to our episode sponsor, Feroot All links and the video of this episode can be found on CISO Series.com

April 29, 2022

Global security spending set to hit $198bn by 2025 New malware loader Bumblebee adopted by known ransomware access brokers Cloudflare thwarts record DDoS attack Thanks to today's episode sponsor, Feroot Feroot secures client-side web applications so that businesses can deliver a flawless and safe digital user experience to their customers. Inspector and Pageguard, Feroot's automated data protection solutions, increase code visibility, facilitate threat analysis, and detect and protect from dangerous client-side attacks, such as Magecart, cross-site scripting, e-skimming, and other threats focused on front-end JavaScript and web applications. Learn more at www.feroot.com. For the stories behind the headlines, head to...

April 28, 2022

Russia experiences hacks at scale State Department puts a price on NetPetya's head Two-thirds of organizations hit with ransomware Thanks to today's episode sponsor, Feroot Feroot secures client-side web applications so that businesses can deliver a flawless and safe digital user experience to their customers. Inspector and Pageguard, Feroot's automated data protection solutions, increase code visibility, facilitate threat analysis, and detect and protect from dangerous client-side attacks, such as Magecart, cross-site scripting, e-skimming, and other threats focused on front-end JavaScript and web applications. Learn more at www.feroot.com.

April 27, 2022

Elon Musk's Twitter takeover could be bad for security and privacy Stormous Ransomware targets Coca Cola US offers $10 million reward for help locating Russian hackers Thanks to today's episode sponsor, Feroot Feroot secures client-side web applications so that businesses can deliver a flawless and safe digital user experience to their customers. Inspector and Pageguard, Feroot's automated data protection solutions, increase code visibility, facilitate threat analysis, and detect and protect from dangerous client-side attacks, such as Magecart, cross-site scripting, e-skimming, and other threats focused on front-end JavaScript and web applications. Learn more at www.feroot.com. For the stories behind the headlines,...

April 26, 2022

Mandiant finds record zero-days in 2021 Bored Ape Yacht Club hacked Oracle patches critical Java vulnerability Thanks to today's episode sponsor, Feroot Feroot secures client-side web applications so that businesses can deliver a flawless and safe digital user experience to their customers. Inspector and Pageguard, Feroot's automated data protection solutions, increase code visibility, facilitate threat analysis, and detect and protect from dangerous client-side attacks, such as Magecart, cross-site scripting, e-skimming, and other threats focused on front-end JavaScript and web applications. Learn more at www.feroot.com.

April 25, 2022

Hackers find 122 vulnerabilities, 27 deemed critical, during first round of DHS bug bounty program Anonymous has leaked 5.8 TB of Russian data since declaring cyber war AWS's Log4j patches blew holes in its own security Thanks to today's episode sponsor, Feroot Feroot secures client-side web applications so that businesses can deliver a flawless and safe digital user experience to their customers. Inspector and Pageguard, Feroot's automated data protection solutions, increase code visibility, facilitate threat analysis, and detect and protect from dangerous client-side attacks, such as Magecart, cross-site scripting, e-skimming, and other threats focused on front-end JavaScript and web applications....

April 22, 2022

Critical chipset bugs open millions of Android devices to remote spying New Five Eyes alert warns of Russian threats targeting critical infrastructure Machine-learning models vulnerable to undetectable backdoors And here's a word from our sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com. For the stories behind the headlines,...

April 21, 2022

Okta reports on Lapsus$ breach Popular VPNs use risky certificates Project Zero disclosed a new vulnerability record And here's a word from our sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com.

April 20, 2022

LinkedIn is now the most popular phish bait Lenovo patches firmware vulnerabilities impacting millions of users Ukraine war stokes internet connectivity concerns in Taiwan And here's a word from our sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com. For the stories behind the headlines, head to CISOseries.com

April 19, 2022

Catalan leaders targeted by NSO spyware Researchers share a deep dive into PYSA ransomware operations Most security teams feeling the talent shortage And here's a word from our sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at Votiro.com.

April 18, 2022

Microsoft: Office 2013 will reach end of support in April 2023 Stolen OAuth tokens used to download data from dozens of organizations, GitHub warns Mute button in conferencing apps may not actually mute your mic And here's a word from our sponsor, Votiro Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything including Microsoft 365. Learn more at...

April 15, 2022

Data breach disclosures surge 14% in Q1 2022 Windows 11 tool to add Google Play secretly installed malware DHS investigators say they foiled cyberattack on undersea internet cable in Hawaii Thanks to our episode sponsor, Code42 Have you been thinking about launching an Insider Risk Management program? You don't need to be Big Brother to effectively address Insider Risk. Code42 believes that the Three Ts should define any IRM program: transparency, training, and technology. Shift your security culture from "watchdog" to "guide dog" and everyone wins. Learn more at Code42.com/showme. For the stories behind the headlines, head to CISOseries.com.

April 14, 2022

Industrial cybersecurity companies form coalition Microsoft disrupts ZLoader T-Mobile hired someone to get their data back Thanks to our episode sponsor, Code42 It's not just about the data leaving your company - what about the data coming in? Along with departing employees, new talent is also actively joining your organization. This poses cybersecurity challenges since they could be knowingly or unknowingly bringing data from their former company into your network. Code42 Incydr is an Insider Risk Management SaaS that provides a comprehensive understanding of your data exposure and shows which activities require security intervention. Learn more at Code42.com/showme.

April 13, 2022

RaidForums hacker marketplace shut down in cross-border law enforcement operation Sandworm hackers fail to take down Ukrainian energy provider CISA warns of Russian state hackers exploiting WatchGuard bug Thanks to our episode sponsor, Code42 Surprise! Surprise! Five years from now, Jamie, who's resigning today, will ring the NASDAQ bell officially launching her company on the public market. And what you'll soon realize is that Jamie stole your most valuable data to start her new company. Learn how Code42 Incydr can stop data theft and protect your organizations' most valuable assets. Visit Code42.com/showme to learn more. For the stories behind the...

April 12, 2022

NSO Group spyware reportedly used against European Commission The malware is coming from inside the phone OpenSSH gets ready for quantum computing Thanks to our episode sponsor, Code42 Cybersecurity teams are facing unprecedented challenges when it comes to protecting sensitive corporate data from exposure, leak and theft. In fact, the Code42 Annual Data Exposure Report revealed there's a 1 in 3 chance that your company will lose IP when an employee quits. To learn more about stopping data leaks with Insider Risk Management visit Code42.com/showme.

April 11, 2022

New Meta information stealer distributed in malspam campaign NB65 group targets Russia with a modified version of Conti's ransomware Elon Musk unveils vision for Twitter after joining board Thanks to our episode sponsor, Code42 Have you been thinking about launching an Insider Risk Management program? You don't need to be Big Brother to effectively address Insider Risk. Code42 believes that the Three Ts should define any IRM program: transparency, training, and technology. Shift your security culture from "watchdog" to "guide dog" and everyone wins. Learn more at Code42.com/showme. For the stories behind the headlines, head to CISOseries.com.

Week in Review Apr 4-8, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Apr 4-8, is hosted byRich Stroffolinowith our guest,Brett Conlon, CISO,American Century Investments Thanks to our sponsor, Code42 It's not just about the data leaving your company what about the data coming in? Along with departing employees, new talent is also actively joining your organization. This poses cybersecurity challenges since they could be knowingly or unknowingly bringing data from their former company into your network. Code42 Incydris an Insider Risk Management SaaS that provides a comprehensive understanding of your data exposure and shows which activities require security intervention. Learn more...

April 8, 2022

Newly discovered flaw could allow hacking of Samsung Android devices Adobe Creative Cloud Experience makes malware easier to hide Parrot redirect service infects 16,500 sites to push malware Thanks to our episode sponsor, Code42 It's not just about the data leaving your company - what about the data coming in? Along with departing employees, new talent is also actively joining your organization. This poses cybersecurity challenges since they could be knowingly or unknowingly bringing data from their former company into your network. Code42 Incydr is an Insider Risk Management SaaS that provides a comprehensive understanding of your data exposure and...

April 7, 2022

US disrupted Russian botnet Twitter shadowbans Russian government accounts DOJ charges Russian national with operating Hydra Thanks to our episode sponsor, Code42 Surprise! Surprise! Five years from now, Jamie, who's resigning today, will ring the NASDAQ bell officially launching her company on the public market. And what you'll soon realize is that Jamie stole your most valuable data to start her new company. Learn how Code42 Incydr can stop data theft and protect your organizations' most valuable assets. Visit Code42.com/showme to learn more.

April 6, 2022

Germany takes down world's largest darknet market Anonymous leaks personal details of Russian soldiers CISA adds Spring4Shell to list of exploited vulnerabilities Thanks to our episode sponsor, Code42 Cybersecurity teams are facing unprecedented challenges when it comes to protecting sensitive corporate data from exposure, leak and theft. In fact, the Code42 Annual Data Exposure Report revealed there's a 1 in 3 chance that your company will lose IP when an employee quits. To learn more about stopping data leaks with Insider Risk Management visit Code42.com/showme. For the stories behind the headlines, visit CISOseries.com

April 5, 2022

Russian secret police exposed in data leak MailChimp hit with breach The Bureau of Cyberspace and Digital Policy goes live Thanks to our episode sponsor, Code42 Have you been thinking about launching an Insider Risk Management program? You don't need to be Big Brother to effectively address Insider Risk. Code42 believes that the Three Ts should define any IRM program: transparency, training, and technology. Shift your security culture from "watchdog" to "guide dog" and everyone wins. Learn more at Code42.com/showme.

April 4, 2022

New Borat remote access malware is no laughing matter Apple rushes out patches for 0-days in MacOS, iOS National Security Agency employee indicted for 'leaking top secret info' Thanks to our episode sponsor, Code42 It's not just about the data leaving your company - what about the data coming in? Along with departing employees, new talent is also actively joining your organization. This poses cybersecurity challenges since they could be knowingly or unknowingly bringing data from their former company into your network. Code42 Incydr is an Insider Risk Management SaaS that provides a comprehensive understanding of your data exposure and...

Week in Review Mar 28-Apr 1, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Mar 28-Apr 1, is hosted byRich Stroffolinowith our guest,Fredrick Lee, CISO,Gusto Thanks to our episode sponsor, Varonis All links and the video of this episode can be found on CISO Series.com

April 1, 2022

Palo Alto Networks error exposed customer support cases, attachments New AcidRain data wiper malware targets modems and routers Remote code execution flaws in Spring and Spring Cloud frameworks put Java apps at risk Thanks to our episode sponsors, Varonis Varonis will help you get meaningful data security results faster than you thought possible. Protect sensitive data, detect sophisticated threats, and streamline privacy and compliance. Visit www.varonis.com/cisoseries for a demo of Varonis' leading data security platform. For the stories behind the headlines, head to CISOseries.com.

March 31, 2022

Hackers abusing the power of subpoena Lapsus$ claims hack of Globant Brian Krebs sued by Ubiquiti for defamation Thanks to our episode sponsors, Varonis The first time we got hit with ransomware it took us weeks to recover. The second time we got hit, it took us two hours. Why? Because we had Varonis. Varonis reduces the ransomware blast radius and monitors our most important data, automatically. Hear more at www.varonis.com/cisoseries.

March 30, 2022

Ukraine destroys panic-spreading bot farms Yandex is sending iOS user data to Russia Ronin Network victimized in record-breaking crypto heist Thanks to our episode sponsors, Varonis Varonis will help you get meaningful data security results faster than you thought possible. Protect sensitive data, detect sophisticated threats, and streamline privacy and compliance. Visit www.varonis.com/cisoseries for a demo of Varonis' leading data security platform. For the stories behind the headlines, visit CISOseries.com.

March 29, 2022

Ukraine ISP taken down by cyber attack Windows can now block drivers Deepfakes take a turn for the banal Thanks to our episode sponsors, Varonis What is your ransomware blast radius? The average user can access 17 million files. Varonis reduces your blast radius in days, not years. Combined with advanced detection that monitors every file touch, ransomware doesn't stand a chance. Learn more at www.varonis.com/cisoseries.

March 28, 2022

Critical Sophos Firewall vulnerability allows remote code execution Okta: "We made a mistake" delaying the Lapsus$ hack disclosure CISA adds 66 new flaws to the Known Exploited Vulnerabilities Catalog Thanks to our episode sponsors, Varonis On average, an employee can access 17 million files on day one. Varonis will show you where critical data is vulnerable, detect anomalies, and automatically right-size privileges to get you to "Zero Trust." Their data security platform can test your ransomware readiness and show you where you stack up. Learn more at www.varonis.com/cisoseries. For the stories behind the headlines, head to CISOseries.com.

Week in Review Mar 21-25, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Mar 21-25, is hosted byRich Stroffolinowith our guest,John Prokap, CISO,Success Academy Charter Schools Thanks to our episode sponsor, Varonis Customer: "The first time we got hit with ransomware it took us weeks to recover. The second time we got hit, it took us two hours. Why? Because we had Varonis. Varonis reduces the ransomware blast radius and monitors our most important data, automatically." Hear more at www.varonis.com/cisoseries. All links and the video of this episode can be found on CISO Series.com

March 25, 2022

UK police arrest 7 people in connection with Lapsus$ North Korean hackers exploit Chrome zero-day weeks before patch Anonymous claims to have hacked the Central Bank of Russia Thanks to our episode sponsor, Varonis The first time we got hit with ransomware it took us weeks to recover. The second time we got hit, it took us two hours. Why? Because we had Varonis. Varonis reduces the ransomware blast radius and monitors our most important data, automatically. Hear more at www.varonis.com/cisoseries. For the stories behind the headlines, head to CISOseries.com.

March 24, 2022

Microsoft expands program to fill cyber skills gap Cyber Crime Losses Up 64% in 2021 Microsoft confirms Lapsus$ breach Thanks to our episode sponsor, Varonis What is your ransomware blast radius? The average employee can access 17 million files they don't need, and only a handful live on their laptop. Protect your data from the inside out and detect early signs of ransomware automatically with Varonis. Visit www.varonis.com/cisoseries.

March 23, 2022

Ransomware attack on Okta leads to data breach Lapsus$ leaks 37GB of Microsoft source code Anonymous hacks Nestl for operating in Russia Thanks to our episode sponsor, Varonis Varonis will help you get meaningful data security results faster than you thought possible. Protect sensitive data, detect sophisticated threats, and streamline privacy and compliance. Visit www.varonis.com/cisoseries for a demo of Varonis' leading data security platform. For the stories behind the headlines, visit CISOseries.com

March 22, 2022

Ransomware puts the breaks on Bridgestone Phishing with browser-in-a-browser attacks Conti Leaks leaks Conti code Thanks to our episode sponsor, Varonis What is your ransomware blast radius? The average user can access 17 million files. Varonis reduces your blast radius in days, not years. Combined with advanced detection that monitors every file touch, ransomware doesn't stand a chance. Learn more at www.varonis.com/cisoseries.

March 21, 2022

CISA, FBI tell satellite communications network owners to watch out for hacks after Ukraine attack Hackers claim to breach TransUnion South Africa with 'Password' password Developer sabotages own npm module prompting open-source supply chain security questions Thanks to our episode sponsor, Varonis On average, an employee can access 17 million files on day one. Varonis will show you where critical data is vulnerable, detect anomalies, and automatically right-size privileges to get you to "Zero Trust." Their data security platform can test your ransomware readiness and show you where you stack up. Learn more at www.varonis.com/cisoseries. For the stories behind the...

Week in Review Mar 14-18, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Mar 14-18, is hosted byDavid Sparkwith our guest,Eric Hussey, CISO,Aptiv Thanks to our episode sponsor, Varonis The first time we got hit with ransomware it took us weeks to recover. The second time we got hit, it took us two hours. Why? Because we hadVaronis. Varonis reduces the ransomware blast radius and monitors our most important data, automatically. Hear more atwww.varonis.com/cisoseries. All links and the video of this episode can be found on CISO Series.com

March 18, 2022

Thanks to our episode sponsor, Varonis The first time we got hit with ransomware it took us weeks to recover. The second time we got hit, it took us two hours. Why? Because we had Varonis. Varonis reduces the ransomware blast radius and monitors our most important data, automatically. Hear more at www.varonis.com/cisoseries.

March 17, 2022

Phony Instagram 'support staff' emails hit insurance company Facebook hit with $18.6 million GDPR fine over 12 data breaches in 2018 Microsoft Defender tags Office updates as ransomware activity Thanks to our episode sponsor, Varonis What is your ransomware blast radius? The average employee can access 17 million files they don't need, and only a handful live on their laptop. Protect your data from the inside out and detect early signs of ransomware automatically with Varonis. Visit www.varonis.com/cisoseries. For the stories behind the headlines, head to CISOseries.com.

March 16, 2022

More destructive wiper malware strikes Ukraine German security agency recommends replacing Kaspersky antivirus HackerOne apologizes to Ukrainian hackers for blocking payouts Thanks to our episode sponsor, Varonis Varonis will help you get meaningful data security results faster than you thought possible. Protect sensitive data, detect sophisticated threats, and streamline privacy and compliance. Visit www.varonis.com/cisoseries for a demo of Varonis' leading data security platform. For the stories behind the headlines, visit CISOseries.com

March 15, 2022

Ukraine's IT army hit with malware Mobile endpoints see a lot of malicious apps AMD vulnerable to Spectre v2 Thanks to our episode sponsor, Varonis What is your ransomware blast radius? The average user can access 17 million files. Varonis reduces your blast radius in days, not years. Combined with advanced detection that monitors every file touch, ransomware doesn't stand a chance. Learn more at www.varonis.com/cisoseries.

March 14, 2022

Ubisoft changes employee passwords after "cyber security incident" Cyber Command chief tells Congress chip shortage has national security implications LockBit claims hack on Bridgestone tires Thanks to our episode sponsor, Varonis On average, an employee can access 17 million files on day one. Varonis will show you where critical data is vulnerable, detect anomalies, and automatically right-size privileges to get you to "Zero Trust." Their data security platform can test your ransomware readiness and show you where you stack up. Learn more at www.varonis.com/cisoseries. For the stories behind the headlines, head to CISOseries.com.

Week in Review Mar 7-11, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Mar 7 11, is hosted byRich Stroffolinowith our guest,Anshu Gupta, Investor,Silicon Valley CISO Investments Thanks to our sponsor, Torq Security Automation Myth 5: You Should Automate All Security Processes False. You should automate routine, repetitive tasks that are not subject to much conditional variance. But workflows that can't be reliably managed by automation tools, such as assessing the financial consequences of a breach or determining whether a security incident should trigger an application rollback, should remain the domain of humans. To learn more about the realities of automation, head...

March 11, 2022

Russia creates its own TLS certificate authority to bypass sanctions Online sleuths are using face recognition to ID Russian soldiers Basic text-color trick can fool phishing filters There are many misconceptions about security automation, so today's episode sponsor Torq is debunking a security automation myth each day this week. Myth 5: You Should Automate All Security Processes False. You should automate routine, repetitive tasks that are not subject to much conditional variance. But workflows that can't be reliably managed by automation tools, such as assessing the financial consequences of a breach or determining whether a security incident should trigger an...

March 10, 2022

Chipmakers warn of new speculative execution bugs US worked to shore up Ukraine's cyber defense in 2021 Twitter Tor service launches There are many misconceptions about security automation, so today's episode sponsor Torq is debunking a security automation myth each day this week. Myth 4: Automation Will Replace Skilled Security Professionals Not true. Any business that attempts to automate security will quickly find that most high-stakes security issues are far too complex to be detected and remediated by automation tools alone. Human security professionals need to take the lead delivering nuanced insight about the business impact of a large-scale breach....

March 9, 2022

Google to purchase cybersecurity firm Mandiant for $5.4 billion Security vendors help infrastructure orgs protect against Russian cyberattacks Russian VPN demand soars amidst social media crackdown There are many misconceptions about security automation, so today's episode sponsor Torq is debunking a security automation myth each day this week. Myth 3: Only Enterprises Need Security Automation Debunked. While enterprises with thousands of endpoints and sprawling teams certainly need automation, businesses of all sizes face challenges related to other forms of scale when it comes to security. For instance, there are about 1 billion known types of malware in existence, and they...

March 8, 2022

Leaked Nvidia data used in malware Russia says it's okay to download a car Sharkbot takes a bite out of the Play Store There are many misconceptions about security automation, so today's episode sponsor Torq is debunking a security automation myth each day this week. Myth 2: Security Automation Is Just a New Term for Automated Security Testing Wrong. While scanning and testing may be one example of a security automation use case, it's hardly the only one. Automation can be used to do things like help manage complex security workflows and optimize collaboration between different stakeholders. These are tasks...

March 7, 2022

Charities and NGOs that provide support to Ukraine hit by malware 'Most advanced' China-linked backdoor ever raises alarms for cyber-espionage investigators Hackers allegedly leak Samsung data, source code There are many misconceptions about security automation, so today's episode sponsor Torq is debunking a security automation myth each day this week. Myth 1: Automation Is Only a Reactive Part of SecOps Incorrect. Proactive management of security incidents is just as important, like automatically scanning IaC configurations to detect vulnerabilities, automating collaboration between devs, IT ops and SecOps to prevent risks before they're threats. To learn more about the realities of automation,...

Week in Review Feb 28-Mar 4, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Feb 28-Mar 4, is hosted byRich Stroffolinowith our guest,Ody Lupescu, CISO,Ethos Life Thanks to our episode sponsor, Torq There are many misconceptions about security automation, so Torq is debunking a security automation myth each day this week. Myth 5: You Should Automate All Security Processes False. You should automate routine, repetitive tasks that are not subject to much conditional variance. But workflows that can't be reliably managed by automation tools, such as assessing the financial consequences of a breach or determining whether a security incident should trigger an application...

March 4, 2022

Cyberattack attempts on Ukraine surge tenfold Ukraine's "IT army" targets Belarus railway network, Russian GPS Eight-character passwords can be cracked in less than 60 minutes There are many misconceptions about security automation, so Torq is debunking a security automation myth each day this week. Myth 5: You Should Automate All Security Processes False. You should automate routine, repetitive tasks that are not subject to much conditional variance. But workflows that can't be reliably managed by automation tools, such as assessing the financial consequences of a breach or determining whether a security incident should trigger an application rollback, should remain the...

March 3, 2022

Conti and Trickbot code leaks API attacks surge in 2021 Log4Shell still being used in the wild There are many misconceptions about security automation, so Torq is debunking a security automation myth each day this week. Myth 4: Automation Will Replace Skilled Security Professionals Not true. Any business that attempts to automate security will quickly find that most high-stakes security issues are far too complex to be detected and remediated by automation tools alone. Human security professionals need to take the lead delivering nuanced insight about the business impact of a large-scale breach. To learn more about the realities of...

March 2, 2022

Russia-Ukraine War update Nvidia confirms company data was stolen in hack Half of employees use unauthorized file services at work There are many misconceptions about security automation, so Torq is debunking a security automation myth each day this week. Myth 3: Only Enterprises Need Security Automation Debunked. While enterprises with thousands of endpoints and sprawling teams certainly need automation, businesses of all sizes face challenges related to other forms of scale when it comes to security. For instance, there are about 1 billion known types of malware in existence, and they imperil businesses of all sizes equally. To learn more...

March 1, 2022

Toyota suspends Japanese production due to cyberattack Microsoft providing threat intelligence to Ukraine Twitter to label tweets from state-owned media There are many misconceptions about security automation, so Torq is debunking a security automation myth each day this week. Myth 2: Security Automation Is Just a New Term for Automated Security Testing Wrong. While scanning and testing may be one example of a security automation use case, it's hardly the only one. Automation can be used to do things like help manage complex security workflows and optimize collaboration between different stakeholders. These are tasks that were not traditionally automated. To...

February 28, 2022

Ukraine recruits volunteer IT army to hack list of Russian entities Russia demands Google restore access to its media YouTube channels in Ukraine Chipmaker giant Nvidia hit by ransomware attack There are many misconceptions about security automation, so Torq is debunking a security automation myth each day this week. Myth 1: Automation Is Only a Reactive Part of SecOps Incorrect. Proactive management of security incidents is just as important, like automatically scanning IaC configurations to detect vulnerabilities, automating collaboration between devs, IT ops and SecOps to prevent risks before they're threats. To learn more about the realities of automation, head...

Week in Review Feb 21-25, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Feb 21-25, is hosted byRich Stroffolinowith our guest,Mark Eggleston, CISO,CSC Thanks to our episode sponsor, Tines Tinesis hosting a virtual game show in conjunction with Lacework on March 8. It's free to attend, with security trivia, fun prizes, and donations going to good causes like Women in Cybersecurity. Places are limited, so head over totines.com/gameshowto register. All links and the video of this episode can be found on CISO Series.com

February 25, 2022

Cyberattacks accompany Russian military assault on Ukraine Putin's government warns Russian critical infrastructure of potential cyberattacks Manufacturing was the top industry targeted by ransomware last year Thanks to our episode sponsor, Tines Tines is hosting a virtual game show in conjunction with Lacework on March 8. It's free to attend, with security trivia, fun prizes, and donations going to good causes like Women in Cybersecurity. Places are limited, so head over to tines.com/gameshow to register. For the stories behind the headlines, head to CISOseries.com.

February 24, 2022

Samsung shipped devices with flawed encryption New York state gets cybersecurity center Microsoft Defender adds support for GCP Thanks to our episode sponsor, Tines Tines is hosting a virtual game show in conjunction with Lacework on March 8. It's free to attend, with security trivia, fun prizes, and donations going to good causes like Women in Cybersecurity. Places are limited, so head over to tines.com/gameshow to register.

February 23, 2022

IRS is allowing taxpayers to opt out of facial recognition UK Defence Secretary warns Russia of cyber-retaliation Slack confirms outage for some users Thanks to our episode sponsor, Tines Tines is hosting a virtual game show in conjunction with Lacework on March 8. It's free to attend, with security trivia, fun prizes, and donations going to good causes like Women in Cybersecurity. Places are limited, so head over to tines.com/gameshow to register. For the stories behind the headlines, head to cisoseries.com

February 22, 2022

Researches find decryption for Hive ransomware In the Google Play Store, no one can hear you scream Linux leads in patching speeds Thanks to our episode sponsor, Tines Tines is hosting a virtual game show in conjunction with Lacework on March 8. It's free to attend, with security trivia, fun prizes, and donations going to good causes like Women in Cybersecurity. Places are limited, so head over to tines.com/gameshow to register.

February 21, 2022

White House attributes Ukraine DDoS incidents to Russia's GRU Master key for Hive ransomware retrieved using a flaw in its encryption algorithm New phishing campaign targets Monzo online-banking customers Thanks to our episode sponsor, Tines Tines is hosting a virtual game show in conjunction with Lacework on March 8. It's free to attend, with security trivia, fun prizes, and donations going to good causes like Women in Cybersecurity. Places are limited, so head over to tines.com/gameshow to register. For the stories behind the headlines, head to CISOseries.com.

Week in Review Feb 14-18, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Feb 14-18, is hosted byRich Stroffolinowith our guest,Mike Hanley, CSO,GitHub Thanks to our episode sponsor, PlexTrac PlexTracis the Purple Teaming Platform. Use the Runbooks Module to facilitate your tabletop exercises, red team engagements, breach and attack simulations, and pentest automation to improve communication and collaboration. PlexTrac upgrades your program's capabilities by making the most of every team member and tool. Check outPlexTrac.com/CISOSeriesto learn why PlexTrac is the perfect platform for CISOs! All links and the video of this episode can be found on CISO Series.com

February 18, 2022

DOJ beefs up efforts to combat criminal use of cryptocurrencies Canada's major banks go offline in mysterious hours-long outage Hackers slip into Microsoft Teams chats to distribute malware Thanks to our episode sponsor, PlexTrac PlexTrac is the Purple Teaming Platform. Use the Runbooks Module to facilitate your tabletop exercises, red team engagements, breach and attack simulations, and pentest automation to improve communication and collaboration. PlexTrac upgrades your program's capabilities by making the most of every team member and tool. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs! For the stories behind the headlines, head to...

February 17, 2022

State-sponsored hackers hits defense contractors Unskilled hacker targeted aviation industry for years Privacy Sandbox heading to Android Thanks to our episode sponsor, PlexTrac Solve your talent shortage with PlexTrac. Use PlexTrac to automate security tasks and workflows to keep your red, blue, and purple teams focused on the real security work. Gain precious time back in your team's day and improve their morale by making them more effective with PlexTrac. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs!

February 16, 2022

Cyberattacks take down Ukrainian military and bank websites Super Bowl ad shines a light on QR code risks CISA directs agencies to patch actively exploited Chrome and Magento bugs Thanks to our episode sponsor, PlexTrac PlexTrac is the solution to deal with your data. Aggregate findings from all assessments to produce the analytics needed to make informed decisions. Produce data visualizations and add them to reports with one click to communicate effectively to leadership. PlexTrac is the premier product for security data management. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs! For the stories behind...

February 15, 2022

FTC warns VoIP providers about robocalls SEC outlines new cybersecurity rules for investment firms Rampant plagiarism hits NFT marketplace Thanks to our episode sponsor, PlexTrac Gain a real-time view of security posture with PlexTrac by consolidating scanner findings, assessments, and bug bounty tools. Visualize your posture in the Analytics Module to quickly assess and prioritize, creating a more effective workflow. Map risks to the MITRE ATT&CK framework to create a living risk register. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs!

February 14, 2022

San Francisco 49ers hit by Blackbyte ransomware attack Linux malware attacks are on the rise, and businesses aren't ready for it Fake Windows 11 upgrade installers deliver RedLine malware Thanks to our episode sponsor, PlexTrac PlexTrac is a powerful, yet simple, cybersecurity platform that centralizes all security assessments, pentest reports, audit findings, and vulnerabilities. PlexTrac transforms the risk management lifecycle, allowing security professionals to generate better reports faster, aggregate and visualize analytics, and collaborate on remediation in real-time. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs! For the stories behind the headlines, head to CISOseries.com.

Week in Review Feb 7-11, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Feb 7-11, is hosted byRich Stroffolinowith our guest,Dave Stirling, CISO,Zions Bancorporation Thanks to our episode sponsor, Datadog Datadog Security Monitoringis part of the Datadog Cloud Security Platform, which protects an organization's production environment and provides threat detection, posture management, workload security, and application security in a single pane of glass. In this Datadog Security Monitoring product brief, you'll learn how to: Solve cloud complexity challenges with threat detection tools, detect and analyze security threats anywhere in your stack, and deploy turnkey detection rules mapped to the MITRE ATT&CK framework....

February 11, 2022

Donation site for Ottawa truckers' "Freedom Convoy" protest exposed donors' data FritzFrog botnet returns to attack healthcare, education, government sectors If you use Zoom on a Mac, you might want to check your microphone settings Thanks to our episode sponsor, Datadog Datadog Security Monitoring is part of the Datadog Cloud Security Platform, which protects an organization's production environment and provides threat detection, posture management, workload security, and application security in a single pane of glass. In this Datadog Security Monitoring product brief, you'll learn how to: Solve cloud complexity challenges with threat detection tools, detect and analyze security threats anywhere...

February 10, 2022

Ukraine takes down social media bot farm Federal use of cell siphoning tech on the rise Microsoft expands security business Thanks to our episode sponsor, Datadog Datadog's Cloud Security Platform delivers real-time threat detection and continuous configuration audits across your entire production environment, so you can bring speed and scale to your security organization. The Cloud Security Platform is built on top of Datadog's observability platform, which breaks down silos between Security and DevOps teams and aligns them to shared organizational goals. To learn more about how Datadog Security Monitoring can solve cloud complexity challenges with a unified platform, download...

February 9, 2022

DOJ arrests New York couple, seizing $3.6 billion in bitcoin Google sees 50% drop in compromises after 2SV enrollment Puma employee data stolen as a result of Kronos attack Thanks to our episode sponsor, Datadog Datadog Security Monitoring is part of the Datadog Cloud Security Platform, which protects an organization's production environment and provides threat detection, posture management, workload security, and application security in a single pane of glass. In this Datadog Security Monitoring product brief, you'll learn how to: Solve cloud complexity challenges with threat detection tools, detect and analyze security threats anywhere in your stack, and deploy turnkey...

February 8, 2022

Stolen crypto used to fund North Korean missile program Microsoft disables protocol used by malware Meta may pull out of the EU Thanks to our episode sponsor, Datadog Datadog's Cloud Security Platform delivers real-time threat detection and continuous configuration audits across your entire production environment, so you can bring speed and scale to your security organization. The Cloud Security Platform is built on top of Datadog's observability platform, which breaks down silos between Security and DevOps teams and aligns them to shared organizational goals. To learn more about how Datadog Security Monitoring can solve cloud complexity challenges with a unified...

February 7, 2022

US House passes bill to boost chip manufacturing and R&D One in seven ransomware extortion attempts leak key operational tech records New Argo CD bug could let hackers steal secret info from Kubernetes apps Thanks to our episode sponsor, Datadog Datadog Security Monitoring is part of the Datadog Cloud Security Platform, which protects an organization's production environment and provides threat detection, posture management, workload security, and application security in a single pane of glass. In this Datadog Security Monitoring product brief, you'll learn how to: Solve cloud complexity challenges with threat detection tools, detect and analyze security threats anywhere in...

Week in Review Jan 31-Feb 4, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Jan 24-Feb 4, is hosted byRich Stroffolinowith our guest,Brian Lozada, CISO,HBOMax Thanks to our episode sponsor, Pentera Align validation to the MITRE ATT&CK framework and the OWASP Top 10. By aligning to industry standards, security teams ensure that their testing covers the latest adversary techniques. Most attacks succeed by leveraging the most common TTPs, so challenging the attack surface against these frameworks provides comprehensive coverage of adversary techniques in the wild. In addition, it allows security executives to clearly report to management on security control efficacy and enterprise readiness...

February 4, 2022

iPhone flaw exploited by second Israeli spy firm Target shares its own web skimming detection tool with the world MFA adoption pushes phishing actors to reverse-proxy solutions Thanks to our episode sponsor, Pentera Align validation to the MITRE ATT&CK framework and the OWASP Top 10. By aligning to industry standards, security teams ensure that their testing covers the latest adversary techniques. Most attacks succeed by leveraging the most common TTPs, so challenging the attack surface against these frameworks provides comprehensive coverage of adversary techniques in the wild. In addition, it allows security executives to clearly report to management on security...

February 3, 2022

Iran-linked APT activity on the rise Hacker claims responsibility for North Korean internet disruptions TikTok: the once and future national security threat Thanks to our episode sponsor, Pentera To continuously know the exploitable attack surface, automate your validation. Security validation must be as dynamic as the attack surface it's securing. Periodical and manual tests aren't enough to challenge the changes an organization undergoes. Security teams need to have an on-demand view of their assets and exposures, and the only way to get there is by automating your testing. Find out more at pentera.io

February 2, 2022

Cyber attack disrupts German oil firm operations Tesla recalls Full Self Driving feature that lets cars roll through stop signs FBI recommends using burner phones at the Olympics Thanks to our episode sponsor, Pentera To understand the exploitable attack surface, security teams need to cover the full scope of potential attacks. Adversaries take the path of least resistance to the critical assets. This means using a variety of techniques to progress an attack, leveraging any vulnerability and its relevant correlations along the way. For this reason, the validation methods used must match - they need to go beyond the static...

February 1, 2022

Your GPU knows your secrets UPnP behind Eternal Silence router campaign DeFi platform hacked for $80 million Thanks to our episode sponsor, Pentera To understand the exploitable attack surface, take the adversarial perspective. The way to know which vulnerabilities are exploitable is towell, exploit them. This way, security teams get a concise attack vector pointing to the organization's weakest link. From here remediation requests handed to IT are focused, manageable, and based on true business impact. Find out more at pentera.io

January 31, 2022

Novel device registration trick enhances multi-stage phishing attacks US bans major Chinese telecom over national security risks Over 20,000 data center management systems exposed to hackers Thanks to our episode sponsor, Pentera Pentera introduces Automated Security Validation! The newly-minted unicorn out of Israel takes a whole new approach to penetration testing - allowing every organization to continuously test the integrity of all cybersecurity layers - including against ransomware - leveraging proprietary ethical exploits to emulate real-world attacks at scale. All day, everyday. This week Pentera will discuss how to identify your exploitable attack surface, so stay tuned for their 'Tip...

Week in Review Jan 24-28, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Jan 24-28, is hosted byRich Stroffolinowith our guest,Gary Hayslip, CISO,Softbank Investment Advisers Thanks to our episode sponsor, deepwatch All links and the video of this episode can be found on CISO Series.com

January 28, 2022

US says national water supply 'absolutely' vulnerable to hackers Microsoft mitigated a record 3.47 Tbps DDoS attack on Azure users BotenaGo Mirai botnet code leaked to GitHub Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working together. For the stories behind...

January 27, 2022

White House releases new cybersecurity strategy Trickbot gets trickier VPNLab shuttered in global takedown Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working together.

January 26, 2022

Canada's foreign ministry hacked Hactivists target Belarus rail system to stop Russian military buildup Segway victimized by Magecart attack Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working together. For the stories behind the headlines, head to CISOseries.com

January 25, 2022

SBA launches cybersecurity program Ransomware gangs step up insider recruitment American Olympians warned to take cybersecurity precautions Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working together.

January 24, 2022

Ukraine attack update: experts find strategic similarities with NotPetya Molerats use Google Drive and Dropbox as attack infrastructure Senators introduce bill to protect satellites from getting hacked Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working together. For the stories behind...

Week in Review Jan 17-21, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Jan 17-21, is hosted byRich Stroffolinowith our guest,Julie Tsai, Cybersecurity Leader Thanks to our episode sponsor, Datadog JoinDatadogin their upcoming webinar to learn how to dissect the anatomy of an attack vector in the cloud with the use of their unified Cloud Security Platform. Visitdatadoghq.com/cisoto register for the webinar in the time zone most convenient for you and attendees will also get a chance to win a Datadog t-shirt. All links and the video of this episode can be found on CISO Series.com

January 21, 2022

NATO and Ukraine sign deal to boost cybersecurity Microsoft Sees Log4j attacks exploiting SolarWinds Serv-U bug Large-scale cyberattack hits the Red Cross Thanks to our episode sponsor, Datadog Join Datadog in their upcoming webinar to learn how to dissect the anatomy of an attack vector in the cloud with the use of their unified Cloud Security Platform. Visit datadoghq.com/ciso to register for the webinar in the time zone most convenient for you and attendees will also get a chance to win a Datadog t-shirt. For the stories behind the headlines, head to CISOseries.com.

January 20, 2022

CISA warns of data-wiping attacks EU working on its own DNS service Biden expands the NSA's cybersecurity purview Thanks to our episode sponsor, Datadog In Datadog's upcoming webinar, you'll learn how to best utilize the suite of Datadog Cloud Security products to identify the root cause of an attack and how a unified platform provides real-time threat-detection and continuous configuration audits across applications, hosts, containers and cloud infrastructure. Visit datadoghq.com/ciso to register for the webinar in the time zone most convenient for you and attendees will also get a chance to win a Datadog t-shirt.

January 19, 2022

Beijing 2022 Winter Olympics app loaded with privacy risks Europol shuts down cybercriminals' VPN service of choice Newspaper accuses Israeli police of spying on its own citizens Thanks to our episode sponsor, Datadog Join Datadog in their upcoming webinar to learn how to dissect the anatomy of an attack vector in the cloud with the use of their unified Cloud Security Platform. Visit datadoghq.com/ciso to register for the webinar in the time zone most convenient for you and attendees will also get a chance to win a Datadog t-shirt. For the stories behind the headlines, head to CISOseries.com

January 18, 2022

Ukraine points fingers in recent cyber attacks Another dark web marketplace calls it quits Renewable energy targeted for cyber espionage Thanks to our episode sponsor, Datadog In Datadog's upcoming webinar, you'll learn how to best utilize the suite of Datadog Cloud Security products to identify the root cause of an attack and how a unified platform provides real-time threat-detection and continuous configuration audits across applications, hosts, containers and cloud infrastructure. Visit datadoghq.com/ciso to register for the webinar in the time zone most convenient for you and attendees will also get a chance to win a Datadog t-shirt.

January 17, 2022

Microsoft discloses malware attack on Ukraine government networks New unpatched Apple Safari browser bug allows cross-site user tracking Now you can get your vulnerability alerts by phone Thanks to our episode sponsor, Datadog Join Datadog in their upcoming webinar to learn how to dissect the anatomy of an attack vector in the cloud with the use of their unified Cloud Security Platform. Visit datadoghq.com/ciso to register for the webinar in the time zone most convenient for you and attendees will also get a chance to win a Datadog t-shirt. For the stories behind the headlines, head to CISOseries.com.

Week in Review Jan 10-14, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Jan 10-14, is hosted byRich Stroffolinowith our guest,Tyler Young, Director, Information Security,Relativity Thanks to our episode sponsor, BlackBerry All links and the video of this episode can be found on CISO Series.com

January 14, 2022

New undetected backdoor runs across three OS platforms Microsoft RDP bug enables data theft, smart-card hijacking Ukrainian police arrests ransomware gang that hit over 50 firms Thanks to our episode sponsor, BlackBerry CISO'sListen Up. Is your team challenged with distinguishing threat signal from noise, reducing cyber costs and finding security talent? We're here to help. BlackBerry Guard is a Managed Extended Detection & Response(XDR) service that merges the Cylance artificial intelligence cybersecurity platform with 24x7 support from award winning responders and prevention experts. Spend time on key security initiatives, instead of the fallout from breaches. Learn more at BlackBerry.com For...

January 13, 2022

EU planning supply chain attack simulations TellYouThePass ransomware returns A look at Senate confirmations for cyber positions Thanks to our episode sponsor, BlackBerry With ransomware attacks like REvil, DarkSide, Conti, and recently Log4Shell, how confident are you in your cyber solution to prevent threats today and into the future? With BlackBerry's Prevention-First endpoint security, we prevent breaches vs responding to and mitigating future attacks. With our Cylance Artificial Intelligence(AI), threats are detected and prevented pre-execution. Traditional AV vendors can't do this. Get Prevention-First protection to keep your data and organization safe. Learn more at BlackBerry.com.

January 12, 2022

Apple to allow third-party app payment options in South Korea Hotel chain switches to Chrome OS to recover from ransomware attack Hackers leveraging Log4j to install NightSky ransomware Thanks to our episode sponsor, BlackBerry Cybersecurity Professionals Listen up. Ransomware is on the rise and you can't afford to rely on ineffective endpoint technology to PREVENT attacks. With BlackBerry's 7th generation Artificial Intelligence(AI) and Machine Learning(ML) technology powered by Cylance, malicious attacks are detected and prevented on average of 25 months BEFORE appearing online. With our prevention-first approach, Cylance technology neutralizes malware before the exploitation stage of the kill-chain. Can your...

January 11, 2022

Open source developer poisons his own well Hacker group self-pwns Microsoft finds TCC bypass vulnerability in macOS Thanks to our episode sponsor, BlackBerry CISO'sListen Up. Is your team challenged with distinguishing threat signal from noise, reducing cyber costs and finding security talent? We're here to help. BlackBerry Guard is a Managed Extended Detection & Response(XDR) service that merges the Cylance artificial intelligence cybersecurity platform with 24x7 support from award winning responders and prevention experts. Spend time on key security initiatives, instead of the fallout from breaches. Learn more at BlackBerry.com

January 10, 2022

Hackers have been sending malware-filled USB sticks to U.S. companies disguised as gifts Swiss army asks its personnel to use the Threema instant-messaging app Norton 360 faces blowback for crypto feature Thanks to our episode sponsor, BlackBerry Cybersecurity Professionals Listen up. Ransomware is on the rise and you can't afford to rely on ineffective endpoint technology to PREVENT attacks. With BlackBerry's 7th generation Artificial Intelligence(AI) and Machine Learning(ML) technology powered by Cylance, malicious attacks are detected and prevented on average of 25 months BEFORE appearing online. With our prevention-first approach, Cylance technology neutralizes malware before the exploitation stage of the...

Week in Review Jan 3-7, 2022

Link to Blog Post This week'sCyber Security Headlines Week in Review, Jan 3-7, is hosted byRich Stroffolinowith our guest,Adam Glick, CISO,SimpliSafe Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visitdeepwatch.comto see how we help to prevent breaches for our customers, by working together. All links and the video of this episode can be found on...

January 7, 2022

Honda, Acura cars hit by Y2K22 bug that rolls back clocks New trick could let malware fake iPhone shutdown to spy on users secretly Attackers exploit flaw in Google Docs' comments feature Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working...

January 6, 2022

Microsoft's digital signature verification exploited New York AG warns of credential stuffing attacks Google acquires Siemplify Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working together.

January 5, 2022

FTC warns of potential penalties for failing to fix Log4j flaws UScellular discloses data breach after billing system hack SlimPay fined for exposing data of 12 million customers for 5 years Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working together....

January 4, 2022

Broward Health discloses major data breach Beware of the command line copy-paste backdoor HomeKit bug can crash iOS devices Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working together.

January 3, 2022

Microsoft Exchange year 2022 bug breaks email delivery Uber email breach allows anyone to email as Uber Crypto security breaches cause $4.25 billion in losses in 2021 Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working together. For the stories behind...

December 30, 2021

Defense bill includes cybersecurity provisions for private-sector Server firmware rootkit discovered Microsoft Defender showing Log4j false positives Thanks to our episode sponsor, Lookout Complexity is the enemy of security. With an integrated Zero Trust platform, Lookout makes things simple. Whether data is on employees' smartphones or in the cloud, Lookout enables organizations to protect sensitive information no matter where it goes. Discover why IDC named the Lookout CASB a major player in its latest MarketScape at lookout.com/idc.

December 29, 2021

LastPass confirms credential stuffing attack against its users Alexa issues deadly challenge to 10-year-old girl Apple aims to retain talent with up to $180,000 bonuses Thanks to our episode sponsor, Lookout Complexity is the enemy of security. With an integrated Zero Trust platform, Lookout makes things simple. Whether data is on employees' smartphones or in the cloud, Lookout enables organizations to protect sensitive information no matter where it goes. Discover why IDC named the Lookout CASB a major player in its latest MarketScape at lookout.com/idc. For the stories behind the headlines, head to CISOseries.com

December 28, 2021

Study looks at ransomware market share Researchers find abundant toolkits to get around 2FA Shutterfly hit with ransomware Thanks to our episode sponsor, Lookout Complexity is the enemy of security. With an integrated Zero Trust platform, Lookout makes things simple. Whether data is on employees' smartphones or in the cloud, Lookout enables organizations to protect sensitive information no matter where it goes. Discover why IDC named the Lookout CASB a major player in its latest MarketScape at lookout.com/idc.

December 27, 2021

Rook ransomware is yet another spawn of the leaked Babuk code Russia fines Google $100m over "illegal" content Fake Christmas Eve termination notices used as phishing lures Thanks to our episode sponsor, Lookout Complexity is the enemy of security. With an integrated Zero Trust platform, Lookout makes things simple. Whether data is on employees' smartphones or in the cloud, Lookout enables organizations to protect sensitive information no matter where it goes. Discover why IDC named the Lookout CASB a major player in its latest MarketScape at lookout.com/idc. For the stories behind the headlines, head to CISOseries.com.

December 24, 2021

CISA releases free scanner to spot Log4j exposure Researchers disclose unpatched vulnerabilities in Microsoft Teams software Microsoft Office patch bypassed for malware distribution in apparent 'dry run' Thanks to our episode sponsor, Lookout Is 2022 the beginning of the end for on-prem security? Two years after remote work became the norm, we're at an inflection point for both threats and security solutions. Just as you wouldn't bring a sword to a gunfight, organizations need to take advantage of integrated cloud solutions to tackle emerging challenges. Check out Lookout's 2022 predictions at lookout.com/predictions. For the stories behind the headlines, head to...

December 23, 2021

Five Eyes issues Log4Shell advisory NSO Group deal with Uganda spurred backlash Microsoft PhotoDNA inverted to reveal images Thanks to our episode sponsor, Lookout Is 2022 the beginning of the end for on-prem security? Two years after remote work became the norm, we're at an inflection point for both threats and security solutions. Just as you wouldn't bring a sword to a gunfight, organizations need to take advantage of integrated cloud solutions to tackle emerging challenges. Check out Lookout's 2022 predictions at lookout.com/predictions.

December 22, 2021

Hack DHS program expanded to include Log4j Tech companies agree to protect data on undersea cable US returns $154 million stolen by Sony employee Thanks to our episode sponsor, Lookout Is 2022 the beginning of the end for on-prem security? Two years after remote work became the norm, we're at an inflection point for both threats and security solutions. Just as you wouldn't bring a sword to a gunfight, organizations need to take advantage of integrated cloud solutions to tackle emerging challenges. Check out Lookout's 2022 predictions at lookout.com/predictions. For the stories behind the headlines, head to CISOseries.com

December 21, 2021

Mobile network vulnerability goes back to 2G UK agency shares password trove with Have I Been Pwned Who watches the DarkWatchman? Thanks to our episode sponsor, Lookout Is 2022 the beginning of the end for on-prem security? Two years after remote work became the norm, we're at an inflection point for both threats and security solutions. Just as you wouldn't bring a sword to a gunfight, organizations need to take advantage of integrated cloud solutions to tackle emerging challenges. Check out Lookout's 2022 predictions at lookout.com/predictions.

December 20, 2021

Log4J New patch and a field day for ransomware Western Digital warns customers to update their My Cloud devices Sainsbury's payroll hit by Kronos attack Thanks to our episode sponsor, Lookout Is 2022 the beginning of the end for on-prem security? Two years after remote work became the norm, we're at an inflection point for both threats and security solutions. Just as you wouldn't bring a sword to a gunfight, organizations need to take advantage of integrated cloud solutions to tackle emerging challenges. Check out Lookout's 2022 predictions at lookout.com/predictions. For the stories behind the headlines, head to CISOseries.com.

Week in Review Dec 13-17, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, Dec 13-17, is hosted by Rich Stroffolino with our guest, Patti Titus, Chief Privacy and Information Security Officer, Markel Thanks to our episode sponsor, Tines All links and the video of this episode can be found on CISO Series.com

December 17, 2021

Hackers begin exploiting second Log4j vulnerability as a third flaw emerges Researchers uncover new coexistence attacks on Wi-Fi and Bluetooth chips North American propane distributor 'Superior Plus' discloses ransomware attack Thanks to our episode sponsor, Tines Tines is no-code automation for security teams, trusted by the world's best companies like Canva, Auth0, and Coinbase. This holiday season, book a 10 minute demo of Tines and we'll donate $100 to your favorite charity we're that certain you'll love what you see. Head over to tines.com/charity to book your 10 minute demo and send $100 to your favorite cause. For the stories...

December 16, 2021

Log4J vulnerability used by APTs Attacks on web apps surge Meta expands bug bounty program to include scraping Thanks to our episode sponsor, Tines Tines is no-code automation for security teams, trusted by the world's best companies like Canva, Auth0, and Coinbase. This holiday season, book a 10 minute demo of Tines and we'll donate $100 to your favorite charity we're that certain you'll love what you see. Head over to tines.com/charity, to book your 10 minute demo and send $100 to your favorite cause.

December 15, 2021

Kronos ransomware outage drives widespread payroll chaos Log4j vulnerability update Microsoft Patch Tuesday addresses zero-day exploited to spread Emotet malware Thanks to our episode sponsor, Tines Tines was founded by experienced security practitioners who cared about their teams. When they couldn't find an automation platform that delivered, they founded a company and built their own. A few years later, customers like Coinbase, McKesson, and GitLab run their most important security workflows on Tines everything from phishing response to employee onboarding. To learn more, visit tines.com. For the stories behind the headlines, head to CISOseries.com

December 14, 2021

New details on the Log4Shell attacks Apple releases Android AirTag detector UKG hit with ransomware Thanks to our episode sponsor, Tines Tines was founded by experienced security practitioners who cared about their teams. When they couldn't find an automation platform that delivered, they founded a company and built their own. A few years later, customers like Coinbase, McKesson, and GitLab run their most important security workflows on Tines everything from phishing response to employee onboarding. To learn more, visit tines.com.

December 13, 2021

German cybersecurity watchdog issues red alert on Log4j Cyber incident reporting mandates suffer another congressional setback Russia blocks Tor web over privacy concerns Thanks to our episode sponsor, Tines You already know how crucial automation is. But why do security analysts still spend so much time on manual tasks? Let's face it legacy tools just haven't delivered on the automation hype. Here's the secret: automation only works when it's built by those who know the process or workflow best your security analysts. So, meet Tines: it's no-code automation, built for the whole team to use. Find out more at tines.com....

Week in Review Dec 6-10, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Dec 6-10, is hosted by David Sparkwith our guest,Paul Truitt, Principal, Mazars Thanks to our episode sponsor, Tines Tinesis no-code automation for security teams, trusted by the world's best companies like Canva, Auth0, and Coinbase. This holiday season, book a 10 minute demo of Tines and we'll donate $100 to your favorite charity we're that certain you'll love what you see. Head over totines.com/charityto book your 10 minute demo and send $100 to your favorite cause. All links and the video of this episode can be found on CISO...

December 10, 2021

Volume of attacks on IoT/OT devices increasing Cloudflare and others form incident response cyber insurance IT execs half as likely to face the axe after breaches, shortages to blame? Thanks to our episode sponsor, Tines Tines is no-code automation for security teams, trusted by the world's best companies like Canva, Auth0, and Coinbase. This holiday season, book a 10 minute demo of Tines and we'll donate $100 to your favorite charity we're that certain you'll love what you see. Head over to tines.com/charity to book your 10 minute demo and send $100 to your favorite cause. For the stories behind...

December 9, 2021

Ransomware hits GitLab and Confluence QNAP is having another bad day A look at health data leaks in 2021 Thanks to our episode sponsor, Tines Tines is no-code automation for security teams, trusted by the world's best companies like Canva, Auth0, and Coinbase. This holiday season, book a 10 minute demo of Tines and we'll donate $100 to your favorite charity we're that certain you'll love what you see. Head over to tines.com/charity, to book your 10 minute demo and send $100 to your favorite cause.

December 8, 2021

AWS outage impacts Ring, Netflix, and Amazon deliveries Google announces lawsuit against Glupteba blockchain botnet Microsoft seized domains used by cyberespionage group Thanks to our episode sponsor, Tines Tines was founded by experienced security practitioners who cared about their teams. When they couldn't find an automation platform that delivered, they founded a company and built their own. A few years later, customers like Coinbase, McKesson, and GitLab run their most important security workflows on Tines everything from phishing response to employee onboarding. To learn more, visit tines.com. For the stories behind the headlines, head to CISOseries.com

December 7, 2021

Biden admin looks to accelerate cybersecurity hiring spree Text message service helped governments track phones US goes on the offensive against ransomware Thanks to our episode sponsor, Tines Tines was founded by experienced security practitioners who cared about their teams. When they couldn't find an automation platform that delivered, they founded a company and built their own. A few years later, customers like Coinbase, McKesson, and GitLab run their most important security workflows on Tines everything from phishing response to employee onboarding. To learn more, visit tines.com.

December 6, 2021

Omicron phishing scam already spotted in UK Pegasus spyware reportedly hacked iPhones of U.S. State Department and diplomats Realistic looking fake Office 365 spam quarantine alerts on the rise Thanks to our episode sponsor, Tines You already know how crucial automation is. But why do security analysts still spend so much time on manual tasks? Let's face it legacy tools just haven't delivered on the automation hype. Here's the secret: automation only works when it's built by those who know the process or workflow best your security analysts. So, meet Tines: it's no-code automation, built for the whole team to...

Week in Review Nov 29-Dec 3, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Nov 29-Dec 3, is hosted byRich Stroffolinowith our guest,Pat Benoit, vp, Global Cyber GRC/BISO,CBRE Thanks to our episode sponsor, Votiro Your users need to accept and open files to do their jobs. Keep them safe and productive withVotiro. With Votiro zero trust file sanitization API, your users can download and use any file instantly, from PDF to Autodesk CAD, with malicious code already removedand full file usability intact. The signatureless file sanitization process happens in milliseconds without user friction. VisitVotiro.comand learn why millions of users trust Votiro to disarm...

December 3, 2021

Emotet now spreads via fake Adobe Windows App Installer packages Data from 400,000 Planned Parenthood patients compromised Double extortion ransomware victims soar 935% Thanks to our episode sponsor, Votiro Your users need to accept and open files to do their jobs. Keep them safe and productive with Votiro. With Votiro zero trust file sanitization API, your users can download and use any file instantly, from PDF to Autodesk CAD, with malicious code already removedand full file usability intact. The signatureless file sanitization process happens in milliseconds without user friction. Visit Votiro.com and learn why millions of users trust Votiro to...

December 2, 2021

AT&T customers hit with malware CISA announces advisory panel Palo Alto Networks looks at speed of compromise in the cloud Thanks to our episode sponsor, Votiro Your users need to accept and open files to do their jobs. Keep them safe and productive with Votiro. With Votiro zero trust file sanitization API, your users can download and use any file instantly, from PDF to Autodesk CAD, with malicious code already removedand full file usability intact. The signatureless file sanitization process happens in milliseconds without user friction. Visit Votiro.com and learn why millions of users trust Votiro to disarm billions of...

December 1, 2021

Twitter bans sharing private images and videos without consent DNA testing firm discloses data breach affecting over 2 million people Critical 'Printing Shellz' bugs impact 150 HP printer models Thanks to our episode sponsor, Votiro Your users need to accept and open files to do their jobs. Keep them safe and productive with Votiro. With Votiro zero trust file sanitization API, your users can download and use any file instantly, from PDF to Autodesk CAD, with malicious code already removedand full file usability intact. The signatureless file sanitization process happens in milliseconds without user friction. Visit Votiro.com and learn why...

November 30, 2021

Dark web market shuts down after DDoS Clearview facing fines in the UK New Chinese surveillance system will target journalists and students Thanks to our episode sponsor, Votiro Your users need to accept and open files to do their jobs. Keep them safe and productive with Votiro. With Votiro zero trust file sanitization API, your users can download and use any file instantly, from PDF to Autodesk CAD, with malicious code already removedand full file usability intact. The signatureless file sanitization process happens in milliseconds without user friction. Visit Votiro.com and learn why millions of users trust Votiro to disarm...

November 29, 2021

RATDispenser spreads multiple remote access trojans into the wild North Korea-linked Zinc group posed as Samsung recruiters to target security firms Interpol arrests over 1,000 suspects linked to cyber crime Thanks to our episode sponsor, Votiro Your users need to accept and open files to do their jobs. Keep them safe and productive with Votiro. With Votiro zero trust file sanitization API, your users can download and use any file instantly, from PDF to Autodesk CAD, with malicious code already removedand full file usability intact. The signatureless file sanitization process happens in milliseconds without user friction. Visit Votiro.com and learn...

November 24, 2021

Over nine million Android devices infected Researcher discloses zero-day exploit due to low bounty payouts Threat actors compromise exposed services in 24 hours Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working together. For the stories behind the headlines, head to...

November 23, 2021

GoDaddy data breach impacts millions Microsoft looks at brute-force attacks Printers used to bypass fingerprint authentication Thanks to our episode sponsor, deepwatch What is the value of good security? Can you quantify what mature detection and response means for your organization? A recent Forrester study found that a deepwatch MDR customer achieved 432% ROI and over 10 million dollars in benefits and savings from their solution over a 3 year period. Visit deepwatch.com/tei-report for the full report and to learn how your team could see the same success.

November 22, 2021

US banks will be required to report cyberattacks within 36 hours Microsoft Exchange malware campaign uses stolen internal reply-chain emails Conti ransomware group suffers a data breach Thanks to our episode sponsor, deepwatch Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working together. For the stories behind...

Week in Review Nov 15-19, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Nov 15-19, is hosted bySean Kellywith our guest,Richard Rushing, CISO,Motorola Mobility Thanks to our episode sponsor, Vulcan Cyber All links and the video of this episode can be found on CISO Series.com

November 19, 2021

PerSwaysion phishing campaign still ongoing, and pervasive FBI: FatPipe VPN zero-day exploited by APT for 6 months RedCurl corporate espionage hackers resume attacks with updated tools Thanks to our episode sponsor, Vulcan Cyber The fact that CISA felt the need to release the massive "Known Exploited Vulnerabilities Catalog" recently says everything we need to know about the state of our collective cyber debt. Attend the Vulcan Cyber virtual summit on December 9th and learn how your peers are working to take on cyber risk and mitigate known vulnerabilities at scale. Go to vulcan.io and click the button at the top...

November 18, 2021

CISA releases cyber response playbooks Exec pleads guilty on internet address fraud Iranian ransomware targeting US organizations Thanks to our episode sponsor, Vulcan Cyber Vulnerability scanners are commoditized. Cloud service providers provide free scanners. Open source scanners are plentiful. Your team doesn't need another scanner, but they need to get better at identifying and prioritizing the risk that is buried in that scan data. Attend the Vulcan Cyber virtual user conference and learn how to assess and mitigate risk across all of your surfaces. Go to vulcan.io and click the button at the top of the screen to register for...

November 17, 2021

Emotet botnet makes comeback with help from TrickBot Leaked Robinhood customer data now up for sale WordPress sites defaced in fake ransomware attacks Thanks to our episode sponsor, Vulcan Cyber Matt Hurewitz is the associate director of application security at Best Buy. Matt has a theory that a risk-based approach to application security is more effective than a faith-based approach. We agree. Attend the Vulcan Cyber virtual summit on December 9th to hear how Matt and the Best Buy team approach application security. Learn from the best. Registration is free for your entire team. Go to vulcan.io and click the...

November 16, 2021

DHS launches program to close cyber talent gap China expands cybersecurity review requirements Microsoft blocks Edge redirects Thanks to our episode sponsor, Vulcan Cyber Ryan Gurney spent years as CSO and security exec for companies like Google Looker, Zendesk, Engine Yard, and eBay. Ryan has seen a few things and is done pretending cyber security is something it isn't. Attend the Vulcan Cyber virtual summit on December 9th to get Ryan's take on the difference between negligent and effective cyber security. It's a fine line. Go to vulcan.io and click the button at the top of the screen to register...

November 15, 2021

FBI email system reportedly hacked to send fake DHS cyberattack messages FBI email hacker blames poor coding US Education Department urged to boost K-12 schools' ransomware defenses Thanks to our episode sponsor, Vulcan Cyber Cyber risk isn't easy to quantify, much less mitigate. Use the same approach endorsed by leading security teams at Honeywell, Zoom, and Wells Fargo to tackle cyber risk. Attend the Vulcan Cyber virtual summit on December 9th and learn how the new Vulcan Security Posture Rating will give you the insights you need to reduce risk and secure your business. Go to vulcan.io and click the...

Week in Review Nov 8-12, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, Nov 8-12, is hosted by Rich Stroffolino with our guest, John Overbaugh, CISO, Alpine Software Group Thanks to our episode sponsor, Vulcan Cyber The fact that CISA felt the need to release the massive "Known Exploited Vulnerabilities Catalog" recently says everything we need to know about the state of our collective cyber debt. Attend the Vulcan Cyber virtual summit on December 9th and learn how your peers are working to take on cyber risk and mitigate known vulnerabilities at scale. Go to vulcan.io and click the button...

November 12, 2021

EU pharmaceutical giants run old, vulnerable apps and fail to use encryption in login forms Gmail accounts are used in 91% of all baiting email attacks Microsoft warns of uptick in HTML smuggling Thanks to our episode sponsor, Vulcan Cyber The fact that CISA felt the need to release the massive "Known Exploited Vulnerabilities Catalog" recently says everything we need to know about the state of our collective cyber debt. Attend the Vulcan Cyber virtual summit on December 9th and learn how your peers are working to take on cyber risk and mitigate known vulnerabilities at scale. Go to vulcan.io...

November 11, 2021

Trend Micro details long running hacker-for-hire group WP Reset PRO plugin works a little too well Zero-day found in Palo Alto Networks security appliances Thanks to our episode sponsor, Vulcan Cyber Vulnerability scanners are commoditized. Cloud service providers provide free scanners. Open source scanners are plentiful. Your team doesn't need another scanner, but they need to get better at identifying and prioritizing the risk that is buried in that scan data. Attend the Vulcan Cyber virtual user conference and learn how to assess and mitigate risk across all of your surfaces. Go to vulcan.io and click the button at the...

November 10, 2021

Robinhood breach impacts millions of customers Meta shares bullying and harassment numbers for the first time Meta to remove sensitive ad-targeting categories as new bill takes aim at online platform algorithms Thanks to our episode sponsor, Vulcan Cyber Matt Hurewitz is the associate director of application security at Best Buy. Matt has a theory that a risk-based approach to application security is more effective than a faith-based approach. We agree. Attend the Vulcan Cyber virtual summit on December 9th to hear how Matt and the Best Buy team approach application security. Learn from the best. Registration is free for your...

November 9, 2021

US infrastructure bill includes cybersecurity provisions Chipmakers respond to US call for supply chain info REvil hackers arrested Thanks to our episode sponsor, Vulcan Cyber Ryan Gurney spent years as CSO and security exec for companies like Google Looker, Zendesk, Engine Yard, and eBay. Ryan has seen a few things and is done pretending cyber security is something it isn't. Attend the Vulcan Cyber virtual summit on December 9th to get Ryan's take on the difference between negligent and effective cyber security. It's a fine line. Go to vulcan.io and click the button at the top of the screen to...

November 8, 2021

Feds likely to fall short of deadline for strengthening encryption, multifactor authentication Experts spot phishing campaign impersonating security firm Proofpoint Facebook outage a prime example of insider threat by machine Thanks to our episode sponsor, Vulcan Cyber Cyber risk isn't easy to quantify, much less mitigate. Use the same approach endorsed by leading security teams at Honeywell, Zoom, and Wells Fargo to tackle cyber risk. Attend the Vulcan Cyber virtual summit on December 9th and learn how the new Vulcan Security Posture Rating will give you the insights you need to reduce risk and secure your business. Go to vulcan.io...

Week in Review Nov 1-5, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Nov 1-5, is hosted byRich Stroffolinowith our guest,Davi Ottenheimer, vp, trust and digital ethics,Inrupt Thanks to our episode sponsor, Trend Micro Reimage your Cloud! That's the theme forCLOUDSEC 2021, a 3-day global event that will be held virtually starting on November 16th. Learn the latest trends in cloud and cybersecurity with global keynotes and session tracks tailored to your role's unique challenges. Test your skills and win prizes in the 24-hr CLOUDSEC Challenge, a hands-on immersive experience that has something for everyone from novice application coders to experienced security...

November 5, 2021

Expired certificate breaks Windows 11 snipping tool, emoji panel, and more Iranian hacking group leaks patient and LGBTQ info Popular 'coa' npm library hijacked to steal user passwords Thanks to our episode sponsor, Trend Micro Reimage your Cloud! That's the theme for CLOUDSEC 2021, a 3-day global event that will be held virtually starting on November 16th. Learn the latest trends in cloud and cybersecurity with global keynotes and session tracks tailored to your role's unique challenges. Test your skills and win prizes in the 24-hr CLOUDSEC Challenge, a hands-on immersive experience that has something for everyone from novice application...

November 4, 2021

CISA creates exploited bug catalog Bots used to scam 2FA codes US sanctions companies selling hacking tools Thanks to our episode sponsor, Trend Micro Reimage your Cloud! That's the theme for CLOUDSEC 2021, a 3-day global event that will be held virtually starting on November 16th. Learn the latest trends in cloud and cybersecurity with global keynotes and session tracks tailored to your role's unique challenges. Test your skills and win prizes in the 24-hr CLOUDSEC Challenge, a hands-on immersive experience that has something for everyone from novice application coders to experienced security practitioners! Join for FREE on November 16th,...

November 3, 2021

Facebook deletes 1 billion faceprints in Face Recognition shutdown Tesla recalls nearly 12,000 vehicles due to software error Android patches actively exploited zero-day kernel bug Thanks to our episode sponsor, Trend Micro Reimage your Cloud! That's the theme for CLOUDSEC 2021, a 3-day global event that will be held virtually starting on November 16th. Learn the latest trends in cloud and cybersecurity with global keynotes and session tracks tailored to your role's unique challenges. Test your skills and win prizes in the 24-hr CLOUDSEC Challenge, a hands-on immersive experience that has something for everyone from novice application coders to experienced...

November 2, 2021

Cyberattack disrupts healthcare in Canadian provinces Researchers discover Pink botnet Facebook takes down government-run troll farm in Nicaragua Thanks to our episode sponsor, Trend Micro Reimage your Cloud! That's the theme for CLOUDSEC 2021, a 3-day global event that will be held virtually starting on November 16th. Learn the latest trends in cloud and cybersecurity with global keynotes and session tracks tailored to your role's unique challenges. Test your skills and win prizes in the 24-hr CLOUDSEC Challenge, a hands-on immersive experience that has something for everyone from novice application coders to experienced security practitioners! Join for FREE on November...

November 1, 2021

Iranian Black Shadow hacking group breaches Israeli Internet hosting firm All Windows versions impacted by new LPE zero-day vulnerability International jeweler Graff hit by Conti gang, with data of its rich clients at risk Thanks to our episode sponsor, Trend Micro Reimage your Cloud! That's the theme for CLOUDSEC 2021, a 3-day global event that will be held virtually starting on November 16th. Learn the latest trends in cloud and cybersecurity with global keynotes and session tracks tailored to your role's unique challenges. Test your skills and win prizes in the 24-hr CLOUDSEC Challenge, a hands-on immersive experience that has...

Week in Review Oct 25-29, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Oct 25-29, is hosted byRich Stroffolinowith our guest,Jason Fruge, CISO,Rent-a-Center Thanks to our episode sponsor, Banyan Security Today, 75% of enterprises are using some form of hybrid-cloud deployment. Unfortunately, traditional network-centric security solutions like VPNs are not designed to meet the scale, performance, and usability needs of modern organizations, especially those with dynamic hybrid- and multi-cloud environments. Replace your traditional network access boxes VPNs, bastion hosts, and gateways with a cloud-based zero trust remote access solution and enable a safe and reliable "work from anywhere" environment. Visit banyansecurity.iofor more...

October 29, 2021

Android spyware spreading as antivirus software in Japan Half of home workers buy potentially insecure technology EU investigating leak of private key used to forge Covid passes And now a word from our sponsor, Banyan Security Today, 75% of enterprises are using some form of hybrid-cloud deployment. Unfortunately, traditional network-centric security solutions like VPNs are not designed to meet the scale, performance, and usability needs of modern organizations, especially those with dynamic hybrid- and multi-cloud environments. Replace your traditional network access boxes VPNs, bastion hosts, and gateways with a cloud-based zero trust remote access solution and enable a safe and...

October 28, 2021

Chinese surveillance tech pulled from US retailers Microsoft warns of rise in password spraying attacks The FTC is looking into the Facebook Files And now a word from our sponsor, Banyan Security Today, 75% of enterprises are using some form of hybrid-cloud deployment. Unfortunately, traditional network-centric security solutions like VPNs are not designed to meet the scale, performance, and usability needs of modern organizations, especially those with dynamic hybrid- and multi-cloud environments. Replace your traditional network access boxes VPNs, bastion hosts, and gateways with a cloud-based zero trust remote access solution and enable a safe and reliable "work from anywhere"...

October 27, 2021

Iranian gas stations out of service after cyberattack Nevada and North Dakota top cybercrime lists Researcher cracked 70% of sampled WiFi networks And now a word from our sponsor, Banyan Security Today, 75% of enterprises are using some form of hybrid-cloud deployment. Unfortunately, traditional network-centric security solutions like VPNs are not designed to meet the scale, performance, and usability needs of modern organizations, especially those with dynamic hybrid- and multi-cloud environments. Replace your traditional network access boxes VPNs, bastion hosts, and gateways with a cloud-based zero trust remote access solution and enable a safe and reliable "work from anywhere" environment....

October 26, 2021

Microsoft report on Nobelium Healthcare organizations struggle with breaches ProtonMail wins appeal on surveillance data And now a word from our sponsor, Banyan Security Today, 75% of enterprises are using some form of hybrid-cloud deployment. Unfortunately, traditional network-centric security solutions like VPNs are not designed to meet the scale, performance, and usability needs of modern organizations, especially those with dynamic hybrid- and multi-cloud environments. Replace your traditional network access boxes VPNs, bastion hosts, and gateways with a cloud-based zero trust remote access solution and enable a safe and reliable "work from anywhere" environment. Visit banyansecurity.io for more information.

October 25, 2021

Crypto-miner and malware found hidden inside npm libraries Facebook sues Ukrainian who scraped the data of 178 million users BlackMatter ransomware victims quietly helped using secret decryptor And now a word from our sponsor, Banyan Security Today, 75% of enterprises are using some form of hybrid-cloud deployment. Unfortunately, traditional network-centric security solutions like VPNs are not designed to meet the scale, performance, and usability needs of modern organizations, especially those with dynamic hybrid- and multi-cloud environments. Replace your traditional network access boxes VPNs, bastion hosts, and gateways with a cloud-based zero trust remote access solution and enable a safe and...

Week in Review Oct 18-22, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Oct 18-22, is hosted byRich Stroffolinowith our guest,Matthew Southworth, CISO,Priceline Thanks to our episode sponsor, Tessian and the Human Layer Security Summit Want to know what we learned from analyzing 2 million malicious emails? AtTessian's Human Layer Summityou'll hear about new threat intelligence into the state of spear phishing. Guest speakers from TrustedSec and KnowBe4 will discuss what kind of attacks are getting through typical enterprise defences, what that means for user protection and what security leaders need to do about it. Join in on the conversation to learn...

October 22, 2021

Cybercrime matures as hackers are forced to work smarter FIN7 tries to trick pentesters into launching ransomware attacks China VPN exposes data for 1M users Thanks to our episode sponsor, Tessian and the Human Layer Security Summit Want to know what we learned from analyzing 2 million malicious emails? At Tessian's Human Layer Summit you'll hear about new threat intelligence into the state of spear phishing. Guest speakers from TrustedSec and KnowBe4 will discuss what kind of attacks are getting through typical enterprise defences, what that means for user protection and what security leaders need to do about it. Join...

October 21, 2021

Russian firms see DDoS spike Sinclair hack linked to Russian organization Microsoft expires old Windows updates Thanks to our episode sponsor, Tessian and the Human Layer Security Summit Want to get the latest security insights from Cisco, Forrester, Intercontinental Exchange and Knowbe4? At Tessian's Human Layer Security Summit you'll get fresh insights and actionable advice to help you build an effective, future proof security strategy. Hear from top CISOs and InfoSec Leaders who will speak on the HOTTEST topics in cyber today. Join thousands of your peers by registering now at tessian.com/summit

October 20, 2021

Ransomware reports signal lack of preparedness and willingness to pay Acer hacked twice in a week by the same threat actor FCC takes aim at spam texts Thanks to our episode sponsor, Tessian and the Human Layer Security Summit Worried if your security stack is enough for today's attack landscape? A recent Forrester Consulting study says, Human Layer Security could be the missing link. At Tessian's Human Layer Security Summit, hear why a commissioned study conducted by Forrester Consulting on behalf of Tessian has identified Human Layer Security as the missing link in enterprise security stacks. The study shows that...

October 19, 2021

Sinclair TV disrupted by ransomware Water system proves easy target for ransomware REvil shuts down again Thanks to our episode sponsor, Tessian and the Human Layer Security Summit Want to know what we learned from analyzing 2 million malicious emails? At Tessian's Human Layer Summit you'll hear about new threat intelligence into the state of spear phishing. Guest speakers from TrustedSec and KnowBe4 will discuss what kind of attacks are getting through typical enterprise defences, what that means for user protection and what security leaders need to do about it. Join in on the conversation to learn about what we...

October 18, 2021

Missouri Governor vows to prosecute St. Louis Post-Dispatch for reporting security vulnerability NFTs now come with wallet-emptying malware Experts hack a fully patched iOS 15 running on iPhone 13 at China's Tianfu Cup hacking contest Thanks to our episode sponsor, Tessian and the Human Layer Security Summit Calling all security trailblazers! Want to get the latest security insights from Cisco, Forrester, Intercontinental Exchange and Knowbe4? At Tessian's Human Layer Security Summit you'll get fresh insights and actionable advice to help you build an effective, future proof security strategy. Hear from top CISOs and InfoSec Leaders who will speak on the...

Week in Review Oct 11-15, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Oct-11-15, is hosted by David Sparkwith our guest,Christopher Zell, CISO,Wendy's Thanks to our episode sponsor, Bitsight All links and the video of this episode can be found on CISO Series.com

October 15, 2021

New "Yanluowang" ransomware variant discovered Financial regulator addresses hybrid working security risks DocuSign phishing campaign targets low-ranking employees Thanks to our episode sponsor, Bitsight These are challenging times for security professionals. From managing third party supply chain risk, to quantifying financial exposure, to reducing the likelihood of ransomware, BitSight helps security and risk professionals create more effective cybersecurity programs with cybersecurity ratings and analytics. Learn why Moody's, the Department of Defense, and other leading institutions partner with BitSight at www.bitsight.com For the stories behind the headlines, head to CISOseries.com.

October 14, 2021

Windows 11 Patch Tuesday causes AMD performance issues Student used zero-day for school prank US leaves China and Russia off the anti-ransomware invite list Thanks to our episode sponsor, Bitsight Did you know that organizations with poor patching practices are 8 times more likely to experience a ransomware incident? From managing third party supply chain risk, to quantifying financial exposure, to reducing the likelihood of ransomware, BitSight helps security and risk professionals create more effective cybersecurity programs with cybersecurity ratings and analytics. Learn why Moody's, the Department of Defense, and other leading institutions partner with BitSight at www.bitsight.com

October 13, 2021

Olympus suffers second cyberattack in 2021 Microsoft's Patch Tuesday squashes four zero-day vulns White House directs federal agencies to step up EDR Thanks to our episode sponsor, Bitsight In spite of all the recent attacks, did you know that only 17% of organizations continuously monitor their third party vendors? From managing third party supply chain risk, to quantifying financial exposure, to reducing the likelihood of ransomware, BitSight helps security and risk professionals create more effective cybersecurity programs with cybersecurity ratings and analytics. Learn why Moody's, the Department of Defense, and other leading institutions partner with BitSight at www.bitsight.com For the...

October 12, 2021

Microsoft report details the changing cybercrime landscape LibreOffice issues fix for signed document spoofing You got nuclear secrets in my peanut butter! Thanks to our episode sponsor, Bitsight Did you know that 1-in-10 organizations are now creating cybersecurity-specific committees at the board level? From managing third party supply chain risk, to quantifying financial exposure, to reducing the likelihood of ransomware, BitSight helps security and risk professionals create more effective cybersecurity programs with cybersecurity ratings and analytics. Learn why Moody's, the Department of Defense, and other leading institutions partner with BitSight at www.bitsight.com

October 11, 2021

Google issues warning for 2 billion Chrome users Bank of America insider charged with money laundering for BEC scams Medtronic recalls insulin pump controllers over cyberattack risks Thanks to our episode sponsor, Bitsight These are challenging times for security professionals. From managing third party supply chain risk, to quantifying financial exposure, to reducing the likelihood of ransomware, BitSight helps security and risk professionals create more effective cybersecurity programs with cybersecurity ratings and analytics. Learn why Moody's, the Department of Defense, and other leading institutions partner with BitSight at www.bitsight.com For the stories behind the headlines, head to CISOseries.com.

Week in Review Oct 4-8, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Oct 4-8, is hosted byRich Stroffolinowith our guest, Adrian Ludwig, Chief Trust Officer, Atlassian Thanks to our episode sponsor, Votiro Your users need to accept and open files to do their jobs. Keep them safe and productive withVotiro. With Votiro, your users can download and use any file instantly, from PDF to Autodesk CAD, with malicious code already removedand full file usability intact. The signatureless, agentless file sanitization process happens in milliseconds without user friction. Visit Votiro.com and learn why millions of users trustVotiroto disarm billions of files each...

October 8, 2021

Twitch blames server error for massive data leak Intel's 80bn European chip plant investment plan not bound for UK because Brexit FIN12 hits healthcare with quick and focused ransomware attacks Thanks to our episode sponsor, Votiro Your users need to accept and open files to do their jobs. Keep them safe and productive with Votiro. With Votiro, your users can download and use any file instantly, from PDF to Autodesk CAD, with malicious code already removedand full file usability intact. The signatureless, agentless file sanitization process happens in milliseconds without user friction. Visit Votiro.com and learn why millions of users...

October 7, 2021

Introducing the Ransom Disclosure Act Facebook details why it suffered a massive outage Twitch's source code leaked Thanks to our episode sponsor, Votiro Your users need to accept and open files to do their jobs. Keep them safe and productive with Votiro. With Votiro, your users can download and use any file instantly, from PDF to Autodesk CAD, with malicious code already removedand full file usability intact. The signatureless, agentless file sanitization process happens in milliseconds without user friction. Visit Votiro.com and learn why millions of users trust Votiro to disarm billions of files each year.

October 6, 2021

Telegram adds 70 million users on the day of Facebook and WhatsApp outage Android October patch fixes three critical bugs Apache fixes actively exploited zero-day vulnerability Thanks to our episode sponsor, Votiro Your users need to accept and open files to do their jobs. Keep them safe and productive with Votiro. With Votiro, your users can download and use any file instantly, from PDF to Autodesk CAD, with malicious code already removedand full file usability intact. The signatureless, agentless file sanitization process happens in milliseconds without user friction. Visit Votiro.com and learn why millions of users trust Votiro to disarm...

October 5, 2021

Major telco exchange company hacked Facebook whistleblower comes out of the shadows Amazon creates amazing phishing tool just in time for Christmas Thanks to our episode sponsor, Votiro Your users need to accept and open files to do their jobs. Keep them safe and productive with Votiro. With Votiro, your users can download and use any file instantly, from PDF to Autodesk CAD, with malicious code already removedand full file usability intact. The signatureless, agentless file sanitization process happens in milliseconds without user friction. Visit Votiro.com and learn why millions of users trust Votiro to disarm billions of files each...

October 4, 2021

Transnational fraud ring stole millions from Army members, veterans Canadian vaccine passport app exposes data Business leaders admit willingness to pay five-figure ransoms Thanks to our episode sponsor, Votiro Your users need to accept and open files to do their jobs. Keep them safe and productive with Votiro. With Votiro, your users can download and use any file instantly, from PDF to Autodesk CAD, with malicious code already removedand full file usability intact. The signatureless, agentless file sanitization process happens in milliseconds without user friction. Visit Votiro.com and learn why millions of users trust Votiro to disarm billions of files...

Week in Review - Sep 27-Oct 1, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Sep 27-Oct-1, is hosted byRich Stroffolinowith our guest,Steve Zalewski, co-host,Defense in Depth Thanks to our episode sponsor, VMware ACCELERATE YOUR OWN ZERO TRUST JOURNEY. The strongest defense against modern threats comes from a Zero Trust posture. The trick is getting there quickly and easily from where you already are. At VMworld 2021 we'll show you how we help you operationalize Zero Trust whatever your starting point. Learn how to get the strongest security for your workloads and workspaces across your Multi-Cloud and Edge with solutions that protect inside and...

October 1, 2021

New leak of Epik data exposes company's entire server New Azure AD bug lets hackers brute-force passwords without getting caught Contactless payment card hack affects Apple Pay, Visa Thanks to our episode sponsor, VMware DO YOU KNOW ANYONE ON THE DEVELOPMENT TEAM WHO'D SAY, 'SECURITY SHOULD BE EVERYONE'S RESPONSIBILITY? Probably not. That's why Forrester and VMware have done some new research that dives into how the Development team perceives Security and what Security teams can do to make the right thing easy. We are hosting a VMworld 2021 session on this report titled "Security is Important, Said No Developer Ever."...

September 30, 2021

Ransomware gangs cause headaches for hacker forums too Don't look a Grifthorse in the mouth Ransomware's impact on patient care Thanks to our episode sponsor, VMware INCIDENT RESPONSE FIRMS ENGAGE POST-BREACH IT'S A FASCINATING VANTAGE POINT WITH LESSONS TO LEARN. Join me and thousands of our peers at VMworld 2021 to hear Dr. Amelia Estwick, Director of Threat Research here at VMware, share her perspective on the ground truth for organizations that have experienced breaches. Not to be missed! Register today at vmware.com/vmworld

September 29, 2021

Microsoft 365 MFA outage locks users out of their accounts Exploit released for VMware vulnerability after CISA warning Crypto developer pleads guilty to North Korean plot Thanks to our episode sponsor, VMware PREPARE FOR THE POST-PANDEMIC THREAT LANDSCAPE. At VMworld 2021, you'll gain fresh insight and actionable knowledge to help keep your focus on building resilient, cyber-vigilant teams that can proactively detect, prevent, mitigate, and remediate these attacks. The Security Track has 150+ breakout sessions with hands-on labs, demos, and interactive experiences. Join thousands of your peers by registering now at vmware.com/vmworld For the stories behind the headlines, head to...

September 28, 2021

Russia muscling Big Tech Data on billions of Clubhouse and Facebook users up for sale Malware targets gamer accounts Thanks to our episode sponsor, VMware BEFORE YOU BUILD AND EVOLVE WHAT COMES NEXT YOU HAVE TO IMAGINE IT. Join me and thousands of our peers at VMworld 2021, the virtual conference where we share how innovation across the VMware portfolio helps make your vision a reality. Register now and join us at vmware.com/vmworld

September 27, 2021

Researcher drops three iOS zero-days that Apple refused to fix Microsoft releases rollback fix for updates New Cooperative ransomware negotiations get hijacked Thanks to our episode sponsor, VMware DO YOU KNOW ANYONE ON THE DEVELOPMENT TEAM WHO'D SAY, 'SECURITY SHOULD BE EVERYONE'S RESPONSIBILITY? Probably not. That's why Forrester and VMware have done some new research that dives into how the Development team perceives Security and what Security teams can do to make the right thing easy. We are hosting a VMworld 2021 session on this report titled "Security is Important, Said No Developer Ever." Join in on our conversation to...

Week in Review - Sep 20-24, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Sep 20-24, 2021, is hosted byRich Stroffolinowith our guest,Brett Conlon, CISO,Edelman Financial Engines Thanks to our episode sponsor, Kanu Solutions Over the next few weeksKanu Solutionsis offering a series of educational sessions on a variety of topics in security, such as endpoints, networks, privileged access management, Internet of things, and governance, risk management and compliance, or GRC. Attend these sessions to get some savvy education from the security experts at Kanu Solutions. You could also get a twenty dollar UberEats Gift Card just for attending. You can participate in...

September 24, 2021

Second farming cooperative shut down by ransomware this week Canadian VoIP provider battles massive DDoS attack REvil double-crosses ransomware affiliates using sneaky backdoor tactics Thanks to our episode sponsor, Kanu Solutions Over the next few weeks Kanu Solutions is offering a series of educational sessions on a variety of topics in security, such as endpoints, networks, privileged access management, Internet of things, and governance, risk management and compliance, or GRC. Attend these sessions to get some savvy education from the security experts at Kanu Solutions. You could also get a twenty dollar UberEats Gift Card just for attending. You can...

September 23, 2021

Let's Encrypt root certificate may cause problems for older devices Now we have to worry about PhaaS Time to patch all the VMware things Thanks to our episode sponsor, Kanu Solutions Over the next few weeks Kanu Solutions is offering a series of educational sessions on a variety of topics in security, such as endpoints, networks, privileged access management, Internet of things, and governance, risk management and compliance, or GRC. Attend these sessions to get some savvy education from the security experts at Kanu Solutions. You could also get a twenty dollar UberEats Gift Card just for attending. You can...

September 22, 2021

Capoae malware brute-forces WordPress sites for cryptomining Malicious email surge predicted for Q4 Farming group warns of supply chain chaos after ransomware attack Thanks to our episode sponsor, Kanu Solutions Over the next few weeks Kanu Solutions is offering a series of educational sessions on a variety of topics in security, such as endpoints, networks, privileged access management, Internet of things, and governance, risk management and compliance, or GRC. Attend these sessions to get some savvy education from the security experts at Kanu Solutions. You could also get a twenty dollar UberEats Gift Card just for attending. You can participate...

September 21, 2021

Google expands app permissions reset Epik confirms it got hacked Telegram suspends Russian election bots Thanks to our episode sponsor, Kanu Solutions Over the next few weeks Kanu Solutions is offering a series of educational sessions on a variety of topics in security, such as endpoints, networks, privileged access management, Internet of things, and governance, risk management and compliance, or GRC. Attend these sessions to get some savvy education from the security experts at Kanu Solutions. You could also get a twenty dollar UberEats Gift Card just for attending. You can participate in Kanu Solutions' Lunch-n-Learn by registering at kanusolutions.com/events.

September 20, 2021

Email scammers posed as DOT officials in phishing messages focused on $1 trillion bill A new banking Trojan abuses YouTube for remote configuration Admin of DDoS service behind 200,000 attacks faces serious prison time Thanks to our episode sponsor, Kanu Solutions Over the next few weeks Kanu Solutions is offering a series of educational sessions on a variety of topics in security, such as endpoints, networks, privileged access management, Internet of things, and governance, risk management and compliance, or GRC. Attend these sessions to get some savvy education from the security experts at Kanu Solutions. You could also get a...

Week in Review - Sep 13-17, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Sep 13-17, 2021, is hosted byRich Stroffolinowith our guest,Geoff Belknap, CISO,LinkedIn Thanks to our episode sponsor, Sonrai Sonraiis changing Public Cloud Security by focusing on protecting data from over-privileged human and non-human identities. Sonrai provides a single pane of glass built on an analytic platform that protects organizations by leveraging CSPM, CIEM, and cloud DLP at the confidence level required by your environment. Learn more aboutSonrai Cloud Securityatwww.sonrai.com All links and the video of this episode can be found on CISO Series.com

September 17, 2021

New Windows security updates break network printing Bitdefender releases decryptor as REvil shows signs of return Biden announces joint deal with U.K. and Australia to counter China Thanks to our episode sponsor, Sonrai Are you a security expert who's afraid to admit you don't know what the heck is going on in your cloud? Relax. Public cloud security is overwhelming. Figuring out where to start, and what to do to track and improve your security posture, is the first step. Sonrai tracks everything in your cloud - sensitive data, identities, and platform configuration - and tells you what issues are...

September 16, 2021

Travis CI security vulnerability is bad news for open source Ransomware accounts for a quarter of cyber insurance claims Microsoft goes passwordless Thanks to our episode sponsor, Sonrai Sonrai is changing Public Cloud Security by focusing on protecting data from over-privileged human and non-human identities. Sonrai provides a single pane of glass built on an analytic platform that protects organizations by leveraging CSPM, CIEM, and cloud DLP at the confidence level required by your environment. Learn more about Sonrai Cloud Security at www.sonrai.com

September 15, 2021

Apple issues urgent updates to fix new zero-day linked to Pegasus spyware Update Google Chrome to patch 2 new zero-day flaws under attack New Zloader attacks disable Windows Defender to evade detection Thanks to our episode sponsor, Sonrai Sonrai is gaelic for data - and that's what Sonrai Security is all about. Finding, classifying, and locking down sensitive data in AWS, Azure, or Google Cloud. Sonrai can see every identity's path to every piece of data - continuously. Learn more at sonraisecurity.com. For the stories behind the headlines, head to CISOseries.com.

September 14, 2021

SSID Stripping is a new take on spoofing Industrial control systems hammered by cyber attacks Olympus has fallen...to ransomware Thanks to our episode sponsor, Sonrai Are you a security expert who's afraid to admit you don't know what the heck is going on in your cloud? Relax. Public cloud security is overwhelming. Figuring out where to start, and what to do to track and improve your security posture, is the first step. Sonrai tracks everything in your cloud - sensitive data, identities, and platform configuration - and tells you what issues are most important, plus it measures improvement over time....

September 13, 2021

Windows MSHTML zero-day exploits shared on hacking forums REvil ransomware operators targeting new victims Yandex pummeled by Meris DDoS botnet Thanks to our episode sponsor, Sonrai Are you a security expert who's afraid to admit you don't know what the heck is going on in your cloud? Relax. Public cloud security is overwhelming. Figuring out where to start, and what to do to track and improve your security posture, is the first step. Sonrai tracks everything in your cloud - sensitive data, identities, and platform configuration - and tells you what issues are most important, plus it measures improvement over...

Week in Review - Sep 6-10, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Sep 6-10, 2021, is hosted by Rich Stroffolino with our guest, Matt Crouse, CISO,Taco Bell Thanks to our episode sponsor, Semperis One thing we've learned from attacks like SolarWinds: Cybercriminals can lurk in your Active Directory environment for weeks or months before dropping malware. How do you root them out? First, you need to uncover security gaps in Active Directory that can lead to a breach. DownloadPurple Knight, a free security assessment tool from Semperis that scans your environment for pre-attack and post-attack indicators of exposure and compromise. Check...

September 10, 2021

US considers limiting CISA director's term 'Azurescape' Kubernetes attack allows cross-container cloud compromise Hackers leak VPN account passwords from 87,000 FortiGate devices Thanks to our episode sponsor, Semperis One thing we've learned from attacks like SolarWinds: Cybercriminals can lurk in your Active Directory environment for weeks or months before dropping malware. How do you root them out? First, you need to uncover security gaps in Active Directory that can lead to a breach. Download Purple Knight, a free security assessment tool from Semperis that scans your environment for pre-attack and post-attack indicators of exposure and compromise. Check it out at...

September 9, 2021

Brad Smith relives early days of the SolarWinds attack Internet Explorer zero-days are still something to worry about German police bought NSO Pegasus spyware Thanks to our episode sponsor, Semperis Have you fixed PrintNightmare yet? Ransomware groups including Vice Society are already exploiting this critical flaw in the Windows Print Spooler service. But you can fight back: Download Purple Knight, a free Active Directory security assessment tool that scans your environment for PrintNightmare and more than 70 other attack indicators. To download your free tool, go to Purple-Knight.com.

September 8, 2021

Ransomware gang threatens to leak data if victim contacts FBI, police Personal details of French visa applicants exposed by cyber-attack Brazil President Bolsonaro restricts powers of social media companies to remove accounts and content Thanks to our episode sponsor, Semperis It's no secret that Active Directory is a prime target for cybercriminals: AD is more than 20 years old, and security settings can get sloppy over time. If you haven't checked your Active Directory environment for risky settings, you might be in for a surprise. To find and fix security gaps, download Purple Knight, a free security assessment tool from...

September 7, 2021

ProtonMail shares user IP address with law enforcement IoT attacks double in six months Study looks at criteria for ransomware targeting Thanks to our episode sponsor, Semperis How would your organization score in an Active Directory security assessment? The average grade for first-time users of Purple Knight, a free security assessment tool from Semperis, is about 68%a barely passing grade. Security and identity managers are shocked at the security gaps this tool has uncovered. But with knowledge comes power. Download Purple Knight so you can find and fix Active Directory security problems. Check it out at Purple-Knight.com.

September 6, 2021

Cyber Command urges patching of massively exploited Confluence bug DDoS hits New Zealand back up again in 30 minutes Salesforce email service used for phishing campaign Thanks to our episode sponsor, Semperis Do you know your Active Directory security vulnerabilities? Cybercriminals love to exploit Active Directory: It has dozens of security gaps because of misconfigurations and new sophisticated hacking tools. But hang on, help is on the way: Download Purple Knight, a free Active Directory security assessment tool from Semperis that scans your environment for 70-plus indicators of exposure and compromise. Check it out at Purple-Knight.com. For the stories behind...

Week in Review - Aug 30-Sep 3, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, Aug 30-Sep 3, 2021, is hosted bySteve Prenticewith our guest,Marnie Wilking, Global Head of Security & Technology Risk Management, Wayfair Thanks to our episode sponsor, Semperis All links and the video of this episode can be found on CISO Series.com

September 3, 2021

WhatsApp faces $267M fine for breaching Europe's GDPR UK VoIP telcos disrupted by cyberattacks White House doubles down on holiday cyberattack warnings Thanks to our episode sponsor, Semperis One thing we've learned from attacks like SolarWinds: Cybercriminals can lurk in your Active Directory environment for weeks or months before dropping malware. How do you root them out? First, you need to uncover security gaps in Active Directory that can lead to a breach. Download Purple Knight, a free security assessment tool from Semperis that scans your environment for pre-attack and post-attack indicators of exposure and compromise. Check it out at...

September 2, 2021

BrakTooth bites major SoC vendors The cost of ransomware to schools Posts surrounding January 6th disappear from Facebook data Thanks to our episode sponsor, Semperis Have you fixed PrintNightmare yet? Ransomware groups including Vice Society are already exploiting this critical flaw in the Windows Print Spooler service. But you can fight back: Download Purple Knight, a free Active Directory security assessment tool that scans your environment for PrintNightmare and more than 70 other attack indicators. To download your free tool, go to Purple-Knight.com.

September 1, 2021

QNAP announces OpenSSL bugs fallout Cyberattackers are now quietly selling off their victim's internet bandwidth Indonesian government's Covid-19 app accidentally exposes over 1 million people Thanks to our episode sponsor, Semperis It's no secret that Active Directory is a prime target for cybercriminals: AD is more than 20 years old, and security settings can get sloppy over time. If you haven't checked your Active Directory environment for risky settings, you might be in for a surprise. To find and fix security gaps, download Purple Knight, a free security assessment tool from Semperis that checks for 70-plus indicators of exposure and...

August 31, 2021

Manual Windows 11 installs might not get updates LockBit to publish Bangkok Air customer data Intermittent encryption hopes to make ransomware worse Thanks to our episode sponsor, Semperis How would your organization score in an Active Directory security assessment? The average grade for first-time users of Purple Knight, a free security assessment tool from Semperis, is about 68%a barely passing grade. Security and identity managers are shocked at the security gaps this tool has uncovered. But with knowledge comes power. Download Purple Knight so you can find and fix Active Directory security problems. Check it out at Purple-Knight.com.

August 30, 2021

"Worst cloud vulnerability you can imagine" discovered in Microsoft Azure Work from home increased worldwide phishing attacks T-Mobile hacker brute-forced his way through the network Thanks to our episode sponsor, Semperis Do you know your Active Directory security vulnerabilities? Cybercriminals love to exploit Active Directory: It has dozens of security gaps because of misconfigurations and new sophisticated hacking tools. But hang on, help is on the way: Download Purple Knight, a free Active Directory security assessment tool from Semperis that scans your environment for 70-plus indicators of exposure and compromise. Check it out at Purple-Knight.com. For the stories behind the...

Week in Review - August 23-27, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, August 23-27, 2021, is hosted bySteve Prenticewith our guest,Edward Contreras, (@CISOEdwardC)CISO,Frost Bank Thanks to our episode sponsor, Privacy.com Privacy.comlets you buy things online using virtual cards instead of having to use your real ones, protecting your identity and bank information on the internet. For example, when you're shopping online and ready to check out, simply generate a Privacy Card that will enter in random variables. Should the merchant ever get hacked, the fraudsters will never have access to your real information. Privacy Cards are also great for monitoring subscriptions...

August 27, 2021

21-year-old claims responsibility for massive T-Mobile hack Microsoft and Google to invest billions to bolster US cybersecurity Ragnarok ransomware releases master decryptor after shutdown Thanks to our episode sponsor, Privacy.com Privacy.com lets you buy things online using virtual cards instead of having to use your real ones, protecting your identity and bank information on the internet. For example, when you're shopping online and ready to check out, simply generate a Privacy Card that will enter in random variables. Should the merchant ever get hacked, the fraudsters will never have access to your real information. Privacy Cards are also great for...

August 26, 2021

Most government agencies use facial recognition Botnet scans for vulnerabilities in Realtek chipsets Does cyber insurance make ransomware worse? Thanks to our episode sponsor, Privacy.com Privacy.com lets you buy things online using virtual cards instead of having to use your real ones, protecting your identity and bank information on the internet. For example, when you're shopping online and ready to check out, simply generate a Privacy Card that will enter in random variables. Should the merchant ever get hacked, the fraudsters will never have access to your real information. Privacy Cards are also great for monitoring subscriptions and signing up...

August 25, 2021

Modded WhatsApp delivers Triada trojan Bahraini activists targeted with new iOS zero-click exploit New CISA director wants to spend less time cleaning up after big hacks, more time preparing for them Thanks to our episode sponsor, Privacy.com Privacy.com lets you buy things online using virtual cards instead of having to use your real ones, protecting your identity and bank information on the internet. For example, when you're shopping online and ready to check out, simply generate a Privacy Card that will enter in random variables. Should the merchant ever get hacked, the fraudsters will never have access to your real...

August 24, 2021

Apple started scanning for CSAM in 2019 Power Apps had leaky APIs Razer mice squeak past user privileges Thanks to our episode sponsor, Privacy.com Privacy.com lets you buy things online using virtual cards instead of having to use your real ones, protecting your identity and bank information on the internet. For example, when you're shopping online and ready to check out, simply generate a Privacy Card that will enter in random variables. Should the merchant ever get hacked, the fraudsters will never have access to your real information. Privacy Cards are also great for monitoring subscriptions and signing up for...

August 23, 2021

Microsoft Exchange under attack with ProxyShell flaws Australians hit by 'Flubot' malware that arrives by text message Cyberattack hits State Department Thanks to our episode sponsor, Privacy.com Privacy.com lets you buy things online using virtual cards instead of having to use your real ones, protecting your identity and bank information on the internet. For example, when you're shopping online and ready to check out, simply generate a Privacy Card that will enter in random variables. Should the merchant ever get hacked, the fraudsters will never have access to your real information. Privacy Cards are also great for monitoring subscriptions and...

Week in Review - August 16-20, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, August 16-20, 2021, is hosted byRich Stroffolinowith our guest,Will Gregorian, Head of Security and Technical Operations,Rhino Thanks to our episode sponsor, Copado The traditional development lifecycle is a game of tradeoffs. You either deploy at blazing speed and put yourself at risk of bugs and breaches or you shore up your security and release software at a snail's pace. But withCopado DevOps, you get the best of both worlds. Leverage Copado's low-code DevOps platform to drive 94% fewer production bugs, 95% faster releases and an average ROI of 307%....

August 20, 2021

Liquid cryptocurrency exchange loses $94 million following hack New unofficial Windows patch fixes more PetitPotam attack vectors New York man sentenced to prison for stealing students' nude photos after hacking their accounts Thanks to our episode sponsor, Copado The traditional development lifecycle is a game of tradeoffs. You either deploy at blazing speed and put yourself at risk of bugs and breaches or you shore up your security and release software at a snail's pace. But with Copado DevOps, you get the best of both worlds. Leverage Copado's low-code DevOps platform to drive 94% fewer production bugs, 95% faster releases...

August 19, 2021

T-Mobile says hackers stole records belonging to 48.6 million individuals OIG issues report on US Census Bureau breach Operator of the Helix bitcoin mixer pleads guilty to money laundering Thanks to our episode sponsor, Copado DevOps is the biggest revolution since the cloud. And Copado happens to be the #1 native DevOps solution for Salesforce and SaaS. So say goodbye to tedious deployments, disconnected teams and security risks. Copado provides visibility over your entire lifecycle and empowers your developers to release software 5 times faster. Want to experience the Copado effect? Get a demo at Copado.com For the stories behind...

August 18, 2021

Chase bank accidentally leaked customer info to other customers Kalay cloud platform flaw exposes millions of IoT devices Data sovereignty laws place new burdens on CISOs Thanks to our episode sponsor, Copado It's no secret software risk has never been higher. In fact, 4 in 5 technology leaders lack confidence in their organizatons' ability to combat cybercrime. Ultimately, your business is only as secure as the software that drives it. That's why Copado's DevOps solution includes built-in security and compliance guardrails to help you derisk your cloud and ramp up software releases. To get a free demo, visit Copado.com. For...

August 17, 2021

Terrorist watchlist exposed online DHS considering using private companies to scan social media Reportedly leaked T-Mobile data for sale online Thanks to our episode sponsor, Copado Implementing Salesforce is like buying a private jet. While you could drive it around your neighborhood, wouldn't you rather learn how to fly it into the clouds? Enter Copado the #1 Native DevOps Solution for Salesforce. Copado unites pro-code and low-code developers on the same platform to unlock visibility, traceability and security from end to end. Want to take Copado for a test drive? Get your demo at Copado.com

August 16, 2021

Ford bug exposed customer and employee records from internal systems Huawei accused in suit of installing data 'back door' in Pakistan project Threat actors turning to RDDoS attacks as a new ransom vector Thanks to our episode sponsor, Copado The traditional development lifecycle is a game of tradeoffs. You either deploy at blazing speed and put yourself at risk of bugs and breaches or you shore up your security and release software at a snail's pace. But with Copado DevOps, you get the best of both worlds. Leverage Copado's low-code DevOps platform to drive 94% fewer production bugs, 95% faster...

Week in Review - August 9-13, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, August 9-13, 2021, is hosted byRich Stroffolinowith our guest,Ben Sapiro, CISO,Canada Life Thanks to our episode sponsor, Sotero All links and the video of this episode can be found on CISO Series.com

August 13, 2021

Another unpatched PrintNightmare zero-day PrintNightmare vulnerability weaponized by ransomware gang Notorious darknet market comes back to life Thanks to our episode sponsor, Sotero It's a new CISO security brief that helps you cut through all the vendor noise and zero in on the best data security solution for your requirements. It includes info on data security technology advances, tips to help you meet your security requirements, and new rapid development capabilities so your development team can implement security features much, much faster. To get the brief, just go to soterosoft.com and click the link at the top of the page....

August 12, 2021

China signals tech crackdown will deepen Poly Network hacker has a change of heart PrintNightmare finally patched for good Thanks to our episode sponsor, Sotero It's a new CISO security brief that helps you cut through all the vendor noise and zero in on the best data security solution for your requirements. It includes info on data security technology advances, tips to help you meet your security requirements, and new rapid development capabilities so your development team can implement security features much, much faster. To get the brief, just go to soterosoft.com and click the link at the top of...

August 11, 2021

eCh0raix ransomware now targets both QNAP and Synology NAS devices At Least 30,000 internet-exposed exchange servers vulnerable to Proxyshell attacks US Senate sends infrastructure bill to House Thanks to our episode sponsor, Sotero It's a new CISO security brief that helps you cut through all the vendor noise and zero in on the best data security solution for your requirements. It includes info on data security technology advances, tips to help you meet your security requirements, and new rapid development capabilities so your development team can implement security features much, much faster. To get the brief, just go to soterosoft.com...

August 10, 2021

Ransomware demands surge in 2021 Flaw found in IOT random number generators Apple says nation states cannot add to CSAM scanning lists Thanks to our episode sponsor, Sotero It's a new CISO security brief that helps you cut through all the vendor noise and zero in on the best data security solution for your requirements. It includes info on data security technology advances, tips to help you meet your security requirements, and new rapid development capabilities so your development team can implement security features much, much faster. To get the brief, just go to soterosoft.com and click the link at...

August 9, 2021

Actively exploited bug bypasses authentication on millions of routers A zero-day RCE in Cisco ADSM has yet to be fixed Password of three random words better than complex variation, experts say Thanks to our episode sponsor, Sotero It's a new CISO security brief that helps you cut through all the vendor noise and zero in on the best data security solution for your requirements. It includes info on data security technology advances, tips to help you meet your security requirements, and new rapid development capabilities so your development team can implement security features much, much faster. To get the brief,...

Week in Review - August 2-6, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, August 2-6, 2021, is hosted byRich Stroffolinowith our guest,Sandy Dunn,Blue Cross of Idaho Thanks to our episode sponsor, PlexTrac All links and the video of this episode can be found on CISO Series.com

August 6, 2021

US partners with Amazon, Google, and Microsoft to help fight cyber threats Conti ransomware gang falls victim to insider data leak Microsoft announces new 'Super Duper' browser security feature Thanks to our episode sponsor, PlexTrac PlexTrac is the Purple Teaming Platform. Use the Runbooks Module to facilitate your tabletop exercises, red team engagements, breach and attack simulations, adversary emulation, and pentest automation to improve communication and collaboration. PlexTrac provides the platform to measure real progress and demonstrate real results. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs! For the stories behind the headlines, head to...

August 5, 2021

Google and Amazon patch DNS-as-a-Service bugs Asian telcos hit by separate Chinese cyber attacks US government struggles against the cyber security skills shortage Thanks to our episode sponsor, PlexTrac Level up your team's capabilities with PlexTrac. Regardless of size, resources, or maturity, every team can take steps to improve defenses against imminent threats like ransomware. PlexTrac is the perfect platform to make the most proactive engagements by tracking tactics, visualizing metrics, supporting communication, and measuring remediation. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs!

August 4, 2021

Federal agencies are failing to protect sensitive data, Senate report finds Spear phishing attackers increasingly targeting non-C-suite employees All apps on Google Play Store will need privacy policy by next April Thanks to our episode sponsor, PlexTrac PlexTrac is the solution to deal with your data. Aggregate findings from all assessments to produce the analytics needed to make informed decisions. Produce data visualizations and add them to reports with one click to communicate effectively to leadership. PlexTrac is the premier product for security data management. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs! For the...

August 3, 2021

APT targeting Microsoft IIS servers Pegasus spyware confirmed on journalist phones Someone is spoofing military ship locations Thanks to our episode sponsor, PlexTrac Gain a real-time view of security posture with PlexTrac by consolidating scanner findings, assessments, and bug bounty tools. Visualize your posture in the Analytics Module to quickly assess and prioritize, creating a more effective workflow. Robust filtering allows for effortless options in viewing and communicating your data. Track your signal through the noise with PlexTrac. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs!

August 2, 2021

BlackMatter ransomware gang rises from the ashes of DarkSide, REvil Remote print server gives anyone Windows admin privileges on a PC Justice Department says Russians hacked federal prosecutors Thanks to our episode sponsor, PlexTrac PlexTrac is a powerful, yet simple, cybersecurity platform that centralizes all security assessments, pentest reports, audit findings, and vulnerabilities. PlexTrac transforms the risk management lifecycle, allowing security professionals to generate better reports faster, aggregate and visualize analytics, and collaborate on remediation in real-time. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs! For the stories behind the headlines, head to CISOseries.com.

July 30, 2021

Biden warns that severe cyberattacks could escalate to an actual war New ransomware gangs emerge on cybercrime forums New Android malware uses VNC to spy and steal victim passwords Thanks to our episode sponsor, Varonis We all know devasting ransomware goes beyond the endpoint. Big game ransomware defense for your cloud and on-prem data is on everyone's mind. Varonis can help ease your worries with a free ransomware preparedness assessment. Visit varonis.com/risk for more information. For the stories behind the headlines, head to CISOseries.com

Week in Review - July 26-30, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, July 26-30, 2021, is hosted byRich Stroffolinowith our guest,Robb Reck(@robbreck), founder and host,Colorado = Cybersecurity Thanks to our sponsor, Varonis What is your ransomware blast radius? The average employee can access 17 million files they don't need, and only a handful live on their laptop. Protect your data from the inside out and detect early signs of ransomware automatically with Varonis. Visit varonis.com/risk All links and the video of this episode can be found on CISO Series.com

July 29, 2021

Federal agencies directed to develop cyber security standards for infrastructure Controversial vulnerability search engine re-released at Defcon The most exploited vulnerabilities of the year Thanks to our episode sponsor, Varonis Varonis will help you get meaningful data security results faster than you thought possible. Protect sensitive data, detect sophisticated threats and streamline privacy and compliance. Visit varonis.com/risk for a demo of Varonis' leading data security platform.

July 28, 2021

Microsoft rushes fix for PetitPotam attack PoC Apple releases urgent zero day bug patch for Mac, iPhone and iPad devices Google launches new Bug Hunters vulnerability rewards platform Thanks to our episode sponsor, Varonis The first time we got hit with ransomware it took us weeks to recover. The second time we got hit, it took us two hours. Why? Because we had Varonis. Varonis reduces the ransomware blast radius and monitors our most important data, automatically. Hear more at varonis.com/risk For the stories behind the headlines, head to CISOseries.com.

July 27, 2021

No More Ransom project five-years in Google Cloud Commits to APIs WhatsApp CEO details 2019 Pegasus spyware attack Thanks to our episode sponsor, Varonis What is your ransomware blast radius? The average user can access 17 million files. Varonis reduces your blast radius in days, not years. Combined with advanced detection that monitors every file touch, ransomware doesn't stand a chance. Learn more at varonis.com/risk

July 26, 2021

French president pushes for Israeli inquiry into NSO spyware concerns Microsoft shares mitigations for new PetitPotam NTLM relay attack Fake Windows 11 installers already distributing malware Thanks to our episode sponsor, Varonis Still in the news is REvil's ransomware attack on Kaseya VSA servers. Varonis is here to help mitigate the blast radius of such attacks. Want a step-by-step guide on what you should be looking for? Visit varonis.com/risk to help make sure your data is protected. For the stories behind the headlines, head to CISOseries.com.

July 23, 2021

NSO Group says to blame its customers Saudi Aramco confirms data leak Sophos to acquire Braintrace Thanks to our episode sponsor, Varonis We all know devasting ransomware goes beyond the endpoint. Big game ransomware defense for your cloud and on-prem data is on everyone's mind. Varonis can help ease your worries with a free ransomware preparedness assessment. Visit varonis.com/risk for more information.

Week in Review - July 19-23, 202

Link to Blog Post This week'sCyber Security Headlines Week in Review, July 19-23, 2021, is hosted bySteve Prentice(@stevenprentice) with our guest, Shawn M. Bowen, CISO, World Fuel Services Thanks to our episode sponsor, Varonis What is your ransomware blast radius? The average employee can access 17 million files they don't need, and only a handful live on their laptop. Protect your data from the inside out and detect early signs of ransomware automatically with Varonis. Visit varonis.com/risk All links and the video of this episode can be found on CISO Series.com

July 22, 2021

Israel creates task force to look into NSO spyware Bill could increase the FTC's role in fighting ransomware NPM package stealing saved browser passwords Thanks to our episode sponsor, Varonis Varonis will help you get meaningful data security results faster than you thought possible. Protect sensitive data, detect sophisticated threats and streamline privacy and compliance. Visit varonis.com/risk for a demo of Varonis' leading data security platform.

July 21, 2021

China fires back at US after Exchange hack accusations Unpatched iPhone bug allows remote device takeover 16-year-old bug in printer software gives hackers admin rights Thanks to our episode sponsor, Varonis The first time we got hit with ransomware it took us weeks to recover. The second time we got hit, it took us two hours. Why? Because we had Varonis. Varonis reduces the ransomware blast radius and monitors our most important data, automatically. Hear more at varonis.com/risk For the stories behind the headlines, head to CISOseries.com

July 20, 2021

Leaked NSO group data hints at widespread Pegasus spyware infections UK and White House blame China for Microsoft Exchange Server hack Saudi Aramco data breach sees 1TB of stolen data for sale Thanks to our episode sponsor, Varonis What is your ransomware blast radius? The average user can access 17 million files. Varonis reduces your blast radius in days, not years. Combined with advanced detection that monitors every file touch, ransomware doesn't stand a chance. Learn more at varonis.com/risk For the stories behind the headlines, head to CISOseries.com.

July 19, 2021

Israeli firm uses Windows zero-days to deploy spyware Cyberattacks increased 17% in Q1 of 2021, with 77% being targeted attacks Another unpatched bug in Windows print spooler Thanks to our episode sponsor, Varonis Still in the news is REvil's ransomware attack on Kaseya VSA servers. Varonis is here to help mitigate the blast radius of such attacks. Want a step-by-step guide on what you should be looking for? Visit varonis.com/risk to help make sure your data is protected. For the stories behind the headlines, head to CISOseries.com.

July 16, 2021

Facebook says it disrupted Iranian Tortoiseshell hacking campaign US offers $10 million reward to combat state-sponsored cyberattacks Report identifies top threats to Tokyo Olympic Games Thanks to our episode sponsor, Varonis We all know devasting ransomware goes beyond the endpoint. Big game ransomware defense for your cloud and on-prem data is on everyone's mind. Varonis can help ease your worries with a free ransomware preparedness assessment. Visit varonis.com/risk for more information. For the stories behind the headlines, head to CISOseries.com

Week in Review - July 12-16, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, July 12-16, 2021, is hosted bySteve Prentice(@stevenprentice) with our guest,Norman Hunt, deputy CISO,GEICO Varonis will help you get meaningful data security results faster than you thought possible. Protect sensitive data, detect sophisticated threats and streamline privacy and compliance. Visitvaronis.com/riskfor a demo ofVaronis' leading data security platform. ll links and the video of this episode can be found on CISO Series.com

July 15, 2021

China issues new zero-day rules Google discloses four zero-days tied to Russian APT Microsoft announces Windows 365 at Inspire 2021 Thanks to our episode sponsor, Varonis Varonis will help you get meaningful data security results faster than you thought possible. Protect sensitive data, detect sophisticated threats and streamline privacy and compliance. Visit varonis.com/risk for a demo of Varonis' leading data security platform.

July 14, 2021

REvil web sites mysteriously shut down New BIOPASS malware livestreams victim's computer screen New CISA director confirmed, White House gains cyber-director Thanks to our episode sponsor, Varonis The first time we got hit with ransomware it took us weeks to recover. The second time we got hit, it took us two hours. Why? Because we had Varonis. Varonis reduces the ransomware blast radius and monitors our most important data, automatically. Hear more at varonis.com/risk For the stories behind the headlines, head to CISOseries.com.

July 13, 2021

Ransomwhere site hopes to provide transparency Microsoft to buy RiskIQ The scope of China's Great Firewall internet censorship Thanks to our episode sponsor, Varonis What is your ransomware blast radius? The average user can access 17 million files. Varonis reduces your blast radius in days, not years. Combined with advanced detection that monitors every file touch, ransomware doesn't stand a chance. Learn more at varonis.com/risk

July 12, 2021

Cyber-attack hits Iran's transport ministry and railways Hackers use a new technique to disable macro security warnings in weaponized docs MacOS targeted in WildPressure APT malware campaign Thanks to our episode sponsor, Varonis Still in the news is REvil's ransomware attack on Kaseya VSA servers. Varonis is here to help mitigate the blast radius of such attacks. Want a step-by-step guide on what you should be looking for? Visit varonis.com/risk to help make sure your data is protected. For the stories behind the headlines, head to CISOseries.com.

July 9, 2021

Phishing campaign spells double-trouble for Kaseya customers Google sued by 36 states over Play Store fees Morgan Stanley falls victim to third-party data breach Thanks to our episode sponsor, Viakoo Want to use 802.1x or TLS certificates on IoT devices, but believe it's hard to manage? It isn't if you use Viakoo. Let Viakoo show you how to manage certificates enterprise-wide from a single console and quickly improve your cyber hygiene. We're available at Viakoo.com. For the stories behind the headlines, head to CISOseries.com

Week in Review - July 5-9, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, July 5-9, 2021, is hosted bySteve Prentice(@stevenprentice) with our guest, Shawn M. Bowen, CISO, World Fuel Services Thanks to our episode sponsor, Viakoo IT vulnerability remediation solutions don't work for IoT. Viakoo's award-winning agentless and automated IoT vulnerability remediation solution can quickly shrink the attack surface created by distributed and unmanaged IoT devices. SeeViakooat Black Hat, and visit us atViakoo.com. All links and the video of this episode can be found on CISO Series.com

July 8, 2021

Russian APT targets Republican National Committee White House urges mayors to review cyber security posture Incomplete PrintNightmare emergency patch released Thanks to our episode sponsor, Viakoo IT vulnerability remediation solutions don't work for IoT. Viakoo's award-winning agentless and automated IoT vulnerability remediation solution can quickly shrink the attack surface created by distributed and unmanaged IoT devices. See Viakoo at Black Hat, and visit us at Viakoo.com.

July 7, 2021

Kaseya patches imminent after zero-day exploits REvil lowers ransom for universal decryptor Pentagon cancels $10 billion JEDI cloud contract that Amazon and Microsoft were fighting over Thanks to our episode sponsor, Viakoo Did you know IP cameras are responsible for 1/3rd of all IoT cyber breaches? And that 7 out of 10 cameras are running out of date firmware? Viakoo has proven solutions to automate cyber hygiene on cameras and other IoT devices. Sign up for a personalized demo at Viakoo.com. And come visit us at Black Hat this year. For the stories behind the headlines, head to CISOseries.com.

July 6, 2021

REvil confirms Kaseya attack White House will attribute Hafnium Exchange hacks Cyber reinsurance rates see a spike Thanks to our episode sponsor, Viakoo Using a discovery solution like Armis, Forescout, Ordr, and others? Great news when you discover vulnerable IoT devices you can automate firmware, certificate, and password management to make those devices secure. Learn more at Viakoo.com.

July 5, 2021

Kaseya was fixing zero-day just as REvil sprang their attack DHS announces most successful cybersecurity hiring initiative in its history Robinhood ordered to pay $70 million over 'harm' caused to millions of traders Thanks to our episode sponsor, RevCult On average, 18 percent of all your Salesforce data fields are highly sensitive and 89 percent of users have access to that data. RevCult is the only solution that helps you understand the data you have in Salesforce, and if you're protecting it. Get afree Salesforce Security Self-Assessmentto understand your Salesforce security weaknesses. For the stories behind the headlines, head to...

July 2, 2021

Russian military cyber-unit behind large-scale brute-force attacks Authorities seize DoubleVPN service used by cybercriminals Microsoft research team reveals critical vulns in Netgear routers Thanks to our episode sponsor, Keyavi Cyber criminals who attack healthcare systems know medical record information has tremendous value for stealing identities. If you infuse personally identifiable information with geographical awareness and intelligence, you dramatically reduce the risk of patient identity theft. Join a live demo session on www.keyavi.com/sessions to learn more.

Week in Review - June 28-July 2, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 28-July 2, 2021, is hosted bySteve Prentice(@stevenprentice) with our guest,Gerhard Rickert, VP, Information Security,Central Pacific Bank Thanks to our episode sponsor, Keyavi Worried about being the next ransomware victim, like Colonial Pipeline? Cyber criminals stole gigabytes of data before their first extortion attempt, demanding payment to decrypt Colonial's information. Despite a multi-million-dollar ransom payment, the pipeline's stolen data is in the hands of these attackers forever. Head towww.keyavi.com/sessionsto learn more about protecting data from extortion attempts. All links and the video of this episode can be found on...

July 1, 2021

Secrecy orders abound in Microsoft's government data requests When proof of concepts go wrong Maine passes strong facial recognition ban Thanks to our episode sponsor, Keyavi Worried about being the next ransomware victim, like Colonial Pipeline? Cyber criminals stole gigabytes of data before their first extortion attempt, demanding payment to decrypt Colonial's information. Despite a multi-million-dollar ransom payment, the pipeline's stolen data is in the hands of these attackers forever. Head to www.keyavi.com/sessions to learn more about protecting data from extortion attempts.

June 30, 2021

Data for 700 million LinkedIn users posted for sale House lawmakers introduce American Cybersecurity Literacy Act to mitigate cyber risks UK foreign secretary's private mobile number has been online for at least 11 years Thanks to our episode sponsor, Keyavi Ransomware is big business. This nightmare usually gives cyber criminals multiple opportunities to hold your data hostage. After stealing it, attackers can also threaten to reveal the contents of your data publicly and damage reputations in the process. If your data self-protects, it becomes totally useless to criminals. Visit www.keyavi.com/sessions to learn how to protect your data from extortion. For...

June 29, 2021

Windows 11 CPU confusion continues EA ignored domain vulnerabilities for months Ransomware increasingly hiding in VMs Thanks to our episode sponsor, Keyavi 7 in 10 white-collar employees in the U.S. are still working remotely. Virtual teams boomed in 2020 and are here to stay. Locking down networks, restricting collaboration and prohibiting BYOD may limit some security risks. But a much bigger attack surface today exposes remote workers to far greater risks. Visit www.keyavi.com/sessions slash-sessions -- to learn how self-protecting data equals peace of mind.

June 28, 2021

Microsoft admits to signing rootkit malware in supply-chain fiasco Senate fails to confirm new CISA director before two-week break, drawing criticism Hackers release free games laced with cryptomining malware Thanks to our episode sponsor, Keyavi Google Security VP Royal Hansen said recently that the biggest security challenge over the next 10 years will be "shifting the focus of security from the technical hygiene of code and configuration to self-defending data." Guess what? Self-protecting data isn't 10 years away it's here now! Visit www.keyavi.com/sessions to see how the previously impossible is now possible. For the stories behind the headlines, head to...

June 25, 2021

Dell bug puts 30 million PCs at risk Irish health services still feel the impact of ransomware Google delays third-party cookie ban Thanks to our episode sponsor, RevCult On average, 18% of all your Salesforce data fields are highly sensitive and 89% of users have access to that data. RevCult is the only solution that helps you understand the data you have in Salesforce, and if you're protecting it. Read our 'CISOs Guide to Salesforce' at RevCult.com.

Week in Review - June 21-25, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, June 21-25, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, Ira Winkler, CISO, Skyline Technology Solutions Thanks to our sponsor, RevCult On average, 18% of all your Salesforce data fields are highly sensitive and 89% of users have access to that data. RevCult is the only solution that helps you understand the data you have in Salesforce, and if you're protecting it. Get a free Salesforce Security Self-Assessment at RevCult.com to understand your Salesforce security weaknesses. All links and the video of this episode can...

June 24, 2021

Antivirus pioneer John McAfee found dead in Spanish prison MITRE releases D3FEND framework Tulsa issues fraud warning after police citation leak Thanks to our episode sponsor, RevCult On average, 18% of all your Salesforce data fields are highly sensitive and 89% of users have access to that data. RevCult is the only solution that helps you understand the data you have in Salesforce, and if you're protecting it. Get a free Salesforce Security Self-Assessment at RevCult.com to understand your Salesforce security weaknesses. For the stories behind the headlines, head to CISOseries.com

June 23, 2021

DirtyMoe is a rapidly growing Windows botnet Majority of web apps in 11 industries are vulnerable all the time Lexmark printers open to arbitrary code-execution Zero-Day Thanks to our episode sponsor, RevCult On average, 18% of all your Salesforce data fields are highly sensitive and 89% of users have access to that data. RevCult is the only solution that helps you understand the data you have in Salesforce, and if you're protecting it. Read our 'CISOs Guide to Salesforce' at RevCult.com. For the stories behind the headlines, head to CISOseries.com

June 22, 2021

Data leak marketplace dials up the pressure Bay Area water treatment plant targeted in cyber attack CISA lacks info on federal agency security Thanks to our episode sponsor, RevCult On average, 18% of all your Salesforce data fields are highly sensitive and 89% of users have access to that data. RevCult is the only solution that helps you understand the data you have in Salesforce, and if you're protecting it. Get a free Salesforce Security Self-Assessment at RevCult.com to understand your Salesforce security weaknesses.

June 21, 2021

New iPhone bug can permanently break WiFi simply by connecting to a rogue hotspot New York City Law Department hacked SASE: 64% of businesses are adopting or plan to adopt in the next year Thanks to our episode sponsor, Viakoo If you discover vulnerable IoT devices on your network, stop port-blocking them. Instead, use Viakoo to remediate vulnerabilities and keep devices delivering their value as full network citizens. Visit Viakoo.com to learn more. And come visit us at Black Hat this year. For the stories behind the headlines, head to CISOseries.com.

June 18, 2021

Ukrainian and South Korean police raids collar Clop ransomware gang suspects Over one billion CVS Health records exposed online Scammers using fake Ledger devices to swipe cryptocurrency Thanks to our episode sponsor, Keyavi Cyber criminals who attack healthcare systems know medical record information has tremendous value for stealing identities. If you infuse personally identifiable information with geographical awareness and intelligence, you dramatically reduce the risk of patient identity theft. Join a live demo session on www.keyavi.com/sessions to learn more. For the stories behind the headlines, head to CISOseries.com

Week in Review - June 14-18, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, June 14-18, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, Peter Liebert (@LiebertPeter), CISO, Cerner Government Services. With all the cybersecurity tools you have, why is your data still vulnerable? You're assuming data cannot protect itself. BUT NOW IT CAN! Need to revoke access after data leaves your possession? Authorize remote locations real-time? Or change permissions on the fly? Seeing is believing. Sign-up at www.keyavi.com/sessions -- that's K-E-Y-A-V-I-dot-com-slash-sessions -- and take control of your data today. All links and the video of this episode can...

June 17, 2021

Biden gives Putin a no-hacking list Facebook's Oversight Board accepts policy opinion Researchers reverse engineer deepfakes Thanks to our episode sponsor, Keyavi Worried about being the next ransomware victim, like Colonial Pipeline? Cyber criminals stole gigabytes of data before their first extortion attempt, demanding payment to decrypt Colonial's information. Despite a multi-million-dollar ransom payment, the pipeline's stolen data is in the hands of these attackers forever. Head to www.keyavi.com/sessions to learn more about protecting data from extortion attempts.

June 16, 2021

Windows 11 leaked "Face of Anonymous" suspect deported from Mexico to face US hacking charges Apple reveals two iOS zero-day vulnerabilities that allow attackers to access fully patched devices Thanks to our episode sponsor, Keyavi Ransomware is big business. This nightmare usually gives cyber criminals multiple opportunities to hold your data hostage. After stealing it, attackers can also threaten to reveal the contents of your data publicly and damage reputations in the process. If your data self-protects, it becomes totally useless to criminals. Visit www.keyavi.com/sessions to learn how to protect your data from extortion. For the stories behind the headlines,...

June 15, 2021

Interpol shuts down thousands of fake pharmacies Chip shortage could lead to counterfeit chip crisis Windows 10 support ends in 2025 Thanks to our episode sponsor, Keyavi 7 in 10 white-collar employees in the U.S. are still working remotely. Virtual teams boomed in 2020 and are here to stay. Locking down networks, restricting collaboration and prohibiting BYOD may limit some security risks. But a much bigger attack surface today exposes remote workers to far greater risks. Visit www.keyavi.com/sessions to learn how self-protecting data equals peace of mind.

June 14, 2021

U.S. suffers over 7 ransomware attacks an hour Chief Operating Officer of network security company charged with cyberattack on medical center REvil hits US nuclear weapons contractor Thanks to our episode sponsor, Keyavi Google Security VP Royal Hansen said recently that the biggest security challenge over the next 10 years will be "shifting the focus of security from the technical hygiene of code and configuration to self-defending data." Guess what? Self-protecting data isn't 10 years away it's here now! Visit www.keyavi.com/sessions to see how the previously impossible is now possible. For the stories behind the headlines, head to CISOseries.com.

June 11, 2021

JBS paid $11 million ransom to cybercriminals Electronic Arts' gaming source code stolen in hack Largest stolen creds market seized by law enforcement Thanks to our sponsor: Trend Micro Want to discover new ways to simplify and strengthen your security? Join Trend Micro Perspectives on June 16, where industry experts and practitioners will share deep insights and real-world examples on how security can play a pivotal role in accelerating your digital transformation. Featuring speakers from Gartner, Forrester, ESG, AWS, and Microsoft. VisitTrendMicro.com/Perspectivestoday to register. For the stories behind the headlines, head toCISOseries.com

Week in Review - June 7-11, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, June 7-11, 2021, is hosted bySteve Prentice(@stevenprentice) with our guest,Robert Wood, CISO,Centers for Medicare & Medicaid Services Thanks to our sponsor: Trend Micro Want to discover new ways to simplify and strengthen your security? Join Trend Micro Perspectives on June 16, where industry experts and practitioners will share deep insights and real-world examples on how security can play a pivotal role in accelerating your digital transformation. Featuring speakers from Gartner, Forrester, ESG, AWS, and Microsoft. Visit TrendMicro.com/Perspectives today to register. All links and the video of this episode can...

June 10, 2021

Cyber-attack disrupts NYC Law Department Amazon successfully presses to omit consumer protections from Senate China bill Intel fixes high severity vulnerabilities with June 2021 platform update Thanks to our sponsor: Trend Micro Want to discover new ways to simplify and strengthen your security? Join Trend Micro Perspectives on June 16, where industry experts and practitioners will share deep insights and real-world examples on how security can play a pivotal role in accelerating your digital transformation. Featuring speakers from Gartner, Forrester, ESG, AWS, and Microsoft. VisitTrendMicro.com/Perspectivestoday to register. For the stories behind the headlines, head toCISOseries.com

June 9, 2021

StackOverflow, Twitch, Reddit, others down in Fastly CDN outage Hundreds arrested in massive global crime sting using messaging app Capitol Hill tech vendor is the latest ransomware victim Thanks to our sponsor: Trend Micro Want to discover new ways to simplify and strengthen your security? Join Trend Micro Perspectives on June 16, where industry experts and practitioners will share deep insights and real-world examples on how security can play a pivotal role in accelerating your digital transformation. Featuring speakers from Gartner, Forrester, ESG, AWS, and Microsoft. Visit TrendMicro.com/Perspectives today to register. For the stories behind the headlines, head to CISOseries.com.

June 8, 2021

US recovers millions in cryptocurrency paid to Colonial Pipeline ransomware hackers Energy chief cites risk of cyberattacks crippling power grid Researchers discover first known malware targeting Windows containers Thanks to our sponsor: Trend Micro Want to discover new ways to simplify and strengthen your security? Join Trend Micro Perspectives on June 16, where industry experts and practitioners will share deep insights and real-world examples on how security can play a pivotal role in accelerating your digital transformation. Featuring speakers from Gartner, Forrester, ESG, AWS, and Microsoft. Visit TrendMicro.com/Perspectives today to register. For the stories behind the headlines, head to CISOseries.com.

June 7, 2021

VMware vulnerability with 9.8 severity rating is under attack GitHub updates policy to remove exploit code when used in active attacks Colonial Pipeline breached via single compromised password Thanks to our sponsor: Trend Micro Want to discover new ways to simplify and strengthen your security? Join Trend Micro Perspectives on June 16, where industry experts and practitioners will share deep insights and real-world examples on how security can play a pivotal role in accelerating your digital transformation. Featuring speakers from Gartner, Forrester, ESG, AWS, and Microsoft. Visit TrendMicro.com/Perspectives today to register. For the stories behind the headlines, head to CISOseries.com.

June 4, 2021

NYC transportation authority hacked using Pulse Secure zero-day Cybercriminals hold contest to find new cryptocurrency exploits FBI confirms REvil as JBS ransomware attacker Thanks to our episode sponsor, ReversingLabs Recent supply chain attacks and executive orders have left 1000's scrambling for guidance. Join ReversingLabs as they take their exclusive supply chain roadshow to your local region virtually. Hear from app sec specialists and security execs, as they discuss lessons learned, and innovative approaches, that will move your supply chain security and compliance program forward. For more information, visit reversinglabs.com. For the stories behind the headlines, head toCISOseries.com

Week in Review - May 31-Jun 4, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, May 31- Jun 4, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, Bryan Zimmer, Head of Security, Humu Thanks to our sponsor, ReversingLabs Recent supply chain attacks and executive orders have left 1000's scrambling for guidance. Join ReversingLabs as they take their exclusive supply chain roadshow to your local region virtually. Hear from app sec specialists and security execs, as they discuss lessons learned, and innovative approaches, that will move your supply chain security and compliance program forward. For more information, visit reversinglabs.com. All links...

June 3, 2021

Florida teen faces charges for DDoS attack on school district UC Browser calls home Ransomware disrupts Massachusetts ferry service Thanks to our episode sponsor, ReversingLabs Recent supply chain attacks and executive orders have left 1000's scrambling for guidance. Join ReversingLabs as they take their exclusive supply chain roadshow to your local region virtually. Hear from app sec specialists and security execs, as they discuss lessons learned, and innovative approaches, that will move your supply chain security and compliance program forward. For more information, visit reversinglabs.com. For the stories behind the headlines, head toCISOseries.com

June 2, 2021

Critical WordPress plugin zero-day under active exploitation Cyberattack forces meat producer to shut down operations in U.S., Australia Russia suspected LinkedIn data shows Austin is biggest winner in tech migration Thanks to our episode sponsor, ReversingLabs Recent supply chain attacks and executive orders have left 1000's scrambling for guidance. Join ReversingLabs as they take their exclusive supply chain roadshow to your local region virtually. Hear from app sec specialists and security execs, as they discuss lessons learned, and innovative approaches, that will move your supply chain security and compliance program forward. For more information, visit reversinglabs.com. For the stories behind...

June 1, 2021

Amazon to opt-in users to Amazon Sidewalk Rowhammer attacks show the downside of density Hacking shuts down Swedish infectious disease database Thanks to our episode sponsor, ReversingLabs Recent supply chain attacks and executive orders have left 1000's scrambling for guidance. Join ReversingLabs as they take their exclusive supply chain roadshow to your local region virtually. Hear from app sec specialists and security execs, as they discuss lessons learned, and innovative approaches, that will move your supply chain security and compliance program forward. For more information, visit reversinglabs.com. For the stories behind the headlines, head toCISOseries.com

May 31, 2021

Two new attacks allow alteration of certified PDF documents US says agencies fended off latest Russian hack involving four new malware families New Epsilon Red ransomware hunts unpatched Microsoft Exchange servers Thanks to our episode sponsor, ReversingLabs Recent supply chain attacks and executive orders have left 1000's scrambling for guidance. Join ReversingLabs as they take their exclusive supply chain roadshow to your local region virtually. Hear from app sec specialists and security execs, as they discuss lessons learned, and innovative approaches, that will move your supply chain security and compliance program forward. For more information, visit reversinglabs.com. For the stories...

May 28, 2021

Twitter urges Indian government to respect free speech French authorities take down their third dark web marketplace Japanese government's data breached after Fujitsu compromise Thanks to our episode sponsor, Sumo Logic Empower your SOC teams with a single platform that addresses security, compliance and configuration. Register for Sumo Logic's Modern SOC Summit June 8-9. Whether you are just getting started or want a technical deep dive, this event has something for you. Reserve your spot for this virtual event at sumologic.com and click on the link at the top of the screen. For the stories behind the headlines, head to...

Week in Review - May 24-28, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, May 24-28, 2021, is hosted by Steve Prentice, with our guest, Jimmy Sanders, CISO, Netflix DVD Thanks to our episode sponsor, Sumo Logic It's time to rethink your security for digital transformation success. Register for Sumo Logic's Modern SOC Summit June 8-9 to debate, discuss and share best practices for modernizing security operations for the rapidly evolving threat landscape. Reserve your spot for this virtual event at sumologic.com and click on the link at the top of the screen. All links and the video of this episode...

May 27, 2021

Belgium disrupts cyber-espionage campaign Facebook says Russia is still the largest producer of misinformation WhatsApp sues over Indian IT laws Thanks to our episode sponsor, Sumo Logic It's time to rethink your security for digital transformation success. Register for Sumo Logic's Modern SOC Summit June 8-9 to debate, discuss and share best practices for modernizing security operations for the rapidly evolving threat landscape. Reserve your spot for this virtual event at sumologic.com and click on the link at the top of the screen.

May 26, 2021

DHS to issue first-ever cybersecurity regulations for pipelines after Colonial hack Audio technology maker Bose discloses data breach after ransomware attack Malware exploited macOS zero-day flaw to secretly take screenshots Thanks to our episode sponsor, Sumo Logic Join security leaders and practitioners at Sumo Logic's Modern SOC Summit June 8-9. Explore, learn and think about the future of your security strategy and direction with a half day program designed for all skill and interest levels. Reserve your spot for this virtual event at sumologic.com and click on the link at the top of the screen. For the stories behind the...

May 25, 2021

8.3 million plaintext passwords leaked Dozens of US towns buy surveillance gear from firms tied to human rights abuses Russia threatens to slow Google Thanks to our episode sponsor, Sumo Logic Empower your SOC teams with a single platform that addresses security, compliance and configuration. Register for Sumo Logic's Modern SOC Summit June 8-9. Whether you are just getting started or want a technical deep dive, this event has something for you. Reserve your spot for this virtual event at sumologic.com and click on the link at the top of the screen.

May 24, 2021

Air India hack covers ten years and three other airlines Wormable Windows IIS vulnerability also affects WinRM on Windows 10 and server systems Insurance giant CNA pays $40m to ransomware crooks Thanks to our episode sponsor, Sumo Logic It's time to rethink your security for digital transformation success. Register for Sumo Logic's Modern SOC Summit June 8-9 to debate, discuss and share best practices for modernizing security operations for the rapidly evolving threat landscape. Reserve your spot for this virtual event at sumologic.com and click on the link at the top of the screen. For the stories behind the headlines,...

May 21, 2021

Millions of Android users' data exposed due to cloud authentication failures UK regulator fines AmEx for spamming violations Russian hacker sentenced to 5 years for $1.5 million tax fraud Thanks to our episode sponsor, Trend Micro Want to discover new ways to simplify and strengthen your security? Join Trend Micro Perspectives on June 16, where industry experts and practitioners will share deep insights and real-world examples on how security can play a pivotal role in accelerating your digital transformation. Featuring speakers from Gartner, Forrester, ESG, AWS, and Microsoft. Visit TrendMicro.com/Perspectives today to register. For the stories behind the headlines, head...

May 20, 2021

Colonial Pipeline confirms it paid the ransom Qlocker ransomware operators shut down SolarWinds CEO speaks about supply chain attack Thanks to our episode sponsor, Trend Micro Want to discover new ways to simplify and strengthen your security? Join Trend Micro Perspectives on June 16, where industry experts and practitioners will share deep insights and real-world examples on how security can play a pivotal role in accelerating your digital transformation. Featuring speakers from Gartner, Forrester, ESG, AWS, and Microsoft. Visit TrendMicro.com/Perspectives today to register.

Week in Review - May 17-21, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, May 17-21, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, Ty Sbano, CISO, Sisense Thanks to our episode sponsor, Trend Micro Want to discover new ways to simplify and strengthen your security? Join Trend Micro Perspectives on June 16, where industry experts and practitioners will share deep insights and real-world examples on how security can play a pivotal role in accelerating your digital transformation. Featuring speakers from Gartner, Forrester, ESG, AWS, and Microsoft. Visit TrendMicro.com/Perspectives today to register. All links and the video of this...

May 19, 2021

DDoS attacks are back, stronger than ever Proof of concept exploit released for wormable Windows vulnerability Tech audit of Colonial Pipeline found 'glaring' problems in 2018 Thanks to our episode sponsor, Trend Micro Want to discover new ways to simplify and strengthen your security? Join Trend Micro Perspectives on June 16, where industry experts and practitioners will share deep insights and real-world examples on how security can play a pivotal role in accelerating your digital transformation. Featuring speakers from Gartner, Forrester, ESG, AWS, and Microsoft. Visit TrendMicro.com/Perspectives today to register. For the stories behind the headlines, head to CISOseries.com.

May 18, 2021

Double encryption ransomware attacks on the rise The UK seeks advice on defending against supply-chain attacks Eufy leaks customer camera feeds to strangers Thanks to our episode sponsor, Trend Micro Want to discover new ways to simplify and strengthen your security? Join Trend Micro Perspectives on June 16, where industry experts and practitioners will share deep insights and real-world examples on how security can play a pivotal role in accelerating your digital transformation. Featuring speakers from Gartner, Forrester, ESG, AWS, and Microsoft. Visit TrendMicro.com/Perspectives today to register.

May 17, 2021

Insurer AXA hit by ransomware after dropping support for ransom payments Darkside says it lost control of servers and money a day after Biden threat CEOs could face jail time for IoT attacks by 2024 Thanks to our episode sponsor, Trend Micro Want to discover new ways to simplify and strengthen your security? Join Trend Micro Perspectives on June 16, where industry experts and practitioners will share deep insights and real-world examples on how security can play a pivotal role in accelerating your digital transformation. Featuring speakers from Gartner, Forrester, ESG, AWS, and Microsoft. Visit TrendMicro.com/Perspectives today to register. For...

May 14, 2021

Colonial Pipeline makes ransom payment of nearly $5 million Biden signs executive order to bolster federal cyber defenses Apple failed to disclose security incident affecting millions of users Thanks to our episode sponsor, Altitude Networks Wouldn't it be great if you could INSTANTLY KNOW if a file containing sensitive information was shared in the wrong way, anywhere in your company AND security had a real time slack notification with a magic "undo button"?! Altitude Networks solves these challenges and protects you from all data leak risks on Google Workspace and Office 365! Altitude Networks is addressing the data security gap...

May 13, 2021

FBI warns of phishing sites using search ads Researcher finds WiFi vulnerable to "frag attacks" Data transfer demonstrated on Apple's Find My network Thanks to our episode sponsor, Altitude Networks Imagine an employee just left and went to a competitor: did they take proprietary documents or critical roadmaps with them? Did they add a backdoor access via personal accounts to documents? You're a cloud-forward company on G Suite, how would you know your data is at risk? Altitude Networks can automatically tell you who is trying to steal your critical cloud data from G Suite and Office 365. Altitude Networks...

Week in Review - May 10-14, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, May 10-14, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, Al Ghous, CISO, Envision Digital Thanks to our episode sponsor, Altitude Networks All links and the video of this episode can be found on CISO Series.com

May 12, 2021

U.S. declares emergency in 17 states over fuel pipeline cyber attack Japanese manufacturer Yamabiko targeted by Babuk ransomware Microsoft May 2021 Patch Tuesday fixes 55 flaws, 3 zero-days Thanks to our episode sponsor, Altitude Networks Imagine an employee just left and went to a competitor: did they take proprietary documents or critical roadmaps with them? Did they add a backdoor access via personal accounts to documents? You're a cloud-forward company on G Suite, how would you know your data is at risk? Altitude Networks can automatically tell you who is trying to steal your critical cloud data from G Suite...

May 11, 2021

Darkside behind the Colonial Pipeline attack Insurance provider ends ransomware reimbursement Tor exit nodes plagued by malware Thanks to our episode sponsor, Altitude Networks Uh oh, Johnny left the company 6 months ago, but still has access to numerous files in Google Drive via his personal account! Do you know how many other former employees and contractors still have access to our documents? It's a lot more than you might think. Altitude Networks automatically discovers sharing to personal accounts and can eliminate it with one click. Altitude Networks is addressing the data security gap in Google Workspace and Office 365....

May 10, 2021

Colonial hackers stole data ahead of pipeline shutdown Microsoft pulls Windows 10 AMD driver causing PCs not to boot New TsuNAME flaw could let attackers take down authoritative DNS servers Thanks to our episode sponsor, Altitude Networks Uh oh, Johnny left the company 6 months ago, but still has access to numerous files in Google Drive via his personal account! Do you know how many other former employees and contractors still have access to our documents? It's a lot more than you might think. Altitude Networks automatically discovers sharing to personal accounts and can eliminate it with one click. Altitude...

May 7, 2021

DOD announces expansion of bug bounty program Data leak uncovers Amazon product review scam DHS to embark on historic hiring initiative Thanks to our episode sponsor, Boxcryptor We think CISOs also have a right to sleep peacefully at night. Therefore, we recommend encrypting your sensitive business data for an extra layer of protection. Now in its 10th year, Boxcryptor offers strong end-to-end encryption for more than 30 cloud providers, NAS, file servers, and local data to organizations of all sizes. Start your free trial now at Boxcryptor.com. For the stories behind the headlines, head to CISOseries.com.

Week in Review - May 3-7, 2021

Link to Blog Post This week's Cyber Security Headlines Week in Review, May 3-7, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, Mitch Parker (@mitchparkerciso), CISO, Indiana University Health. Thanks to our episode sponsor, Boxcryptor We think CISOs also have a right to sleep peacefully at night. Therefore, we recommend encrypting your sensitive business data for an extra layer of protection. Now in its 10th year,Boxcryptoroffers strong end-to-end encryption for more than 30 cloud providers, NAS, file servers, and local data to organizations of all sizes. Start your free trial now atBoxcryptor.com. All links and the video of...

May 6, 2021

Facebook's Oversight Board upholds Trump suspension Phishing for workplace credentials Report looks at third-party SDKs in school apps Thanks to our episode sponsor, Boxcryptor We think CISOs also have a right to sleep peacefully at night. Therefore, we recommend encrypting your sensitive business data for an extra layer of protection. Now in its 10th year, Boxcryptor offers strong end-to-end encryption "Made in Germany" for OneDrive, Dropbox, Google Drive, and Co. as well as for Microsoft Teams. For more information visit Boxcryptor.com.

May 5, 2021

A new set of vulnerabilities may affect 60 percent of the world's public email servers worldwide Hundreds of millions of Dell computers potentially vulnerable to attack Apple products hit by fourfecta of zero-day exploits Thanks to our episode sponsor, Boxcryptor We think CISOs also have a right to sleep peacefully at night. Therefore, we recommend encrypting your sensitive business data for an extra layer of protection. Now in its 10th year, Boxcryptor offers strong end-to-end encryption for more than 30 cloud providers, NAS, file servers, and local data to organizations of all sizes. Start your free trial now at Boxcryptor.com....

May 4, 2021

A look at the Project Signal ransomware campaign Moscow facial recognition system used against protestors Facebook Oversight Board to release Trump decision Wednesday Thanks to our episode sponsor, Boxcryptor We think CISOs also have a right to sleep peacefully at night. Therefore, we recommend encrypting your sensitive business data for an extra layer of protection. Now in its 10th year, Boxcryptor offers strong end-to-end encryption "Made in Germany" for OneDrive, Dropbox, Google Drive, and Co. as well as for Microsoft Teams. For more information visit Boxcryptor.com.

May 3, 2021

New Spectre exploits beat AMD and Intel mitigations Microsoft finds critical code execution bugs in IoT, OT devices New ransomware group uses SonicWall zero-day to breach networks Thanks to our episode sponsor, Boxcryptor We think CISOs also have a right to sleep peacefully at night. Therefore, we recommend encrypting your sensitive business data for an extra layer of protection. Now in its 10th year, Boxcryptor offers strong end-to-end encryption for more than 30 cloud providers, NAS, file servers, and local data to organizations of all sizes. Start your free trial now at Boxcryptor.com. For the stories behind the headlines, head...

April 30, 2021

Babuk ransomware operators announce shutdown Now we need to worry about deepfake satellite images QNAP hit with AgeLocker ransomware Thanks to our episode sponsor, Aptible Compliance teams have a ton of work to do such as completing access reviews, mitigating risks, and collecting evidence towards an audit pst Aptible Comply can help automate all of those things. The last thing the compliance team should be spending time on is sharing infosec documentation. That's why we also created Rooms. Now your security docs are instantly available to your customers; no back-and-forth to sign NDAs, watermark docs, or provide new docs. Focus...

Week in Review - April 26-30, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, April 26-30, 2021, is hosted bySteve Prentice(@stevenprentice) with our guest,Jerich Beason(@blanketSec), CISO,Epiq. Thanks to our episode sponsor, Aptible What do the compliance leaders at Datadog, Pagerduty, Fullstory, Sift, PartnerStack, and many other marque companies have in common? They all understand that the ultimate goal of their work is to build trust with customers. And that's why they all useAptible Complyto automate compliance management, and then they use the Rooms functionality to share their security documentation, making building customer trust easy. If you want to build trust like the best...

April 29, 2021

Linux malware used to backdoor systems for years Intel and Microsoft partner to detect cryptojacking Android contact tracing logs exposed to preinstalled apps Thanks to our episode sponsor, Aptible Remember this? It's the end of the quarter which means urgent sales requests for security documentation. Well, thanks to Aptible Comply those days are over. Comply Rooms is a completely free, sales enablement tool built specifically for compliance teams to provide immediate, self-serve, and secure access to trust packets. With Rooms you just upload your security docs and NDA, then input your customer's emails to invite them where they download automatically...

April 28, 2021

Ransomware gang threatens to expose police informants if ransom is not paid Vulnerabilities in Eaton product can allow hackers to disrupt power supply FBI shares four million email addresses used by Emotet with Have I Been Pwned Thanks to our episode sponsor, Aptible What do the compliance leaders at Datadog, Pagerduty, Fullstory, Sift, PartnerStack, and many other marque companies have in common? They all understand that the ultimate goal of their work is to build trust with customers. And that's why they all use Aptible Comply to automate compliance management, and then they use the Rooms functionality to share their...

April 27, 2021

Software bug opened macOS to malware An analysis of the COMB21 password leak Authorities warn of FluBot Android malware Thanks to our episode sponsor, Aptible Compliance teams have a ton of work to do such as completing access reviews, mitigating risks, and collecting evidence towards an audit pst Aptible Comply can help automate all of those things. The last thing the compliance team should be spending time on is sharing infosec documentation. That's why we also created Rooms. Now your security docs are instantly available to your customers; no back-and-forth to sign NDAs, watermark docs, or provide new docs. Focus...

April 26, 2021

Emotet malware officially removed from all infected devices globally Computer security world in mourning over death of Dan Kaminsky Password manager Passwordstate hacked to deploy malware on customer systems Thanks to our episode sponsor, Aptible Remember this? It's the end of the quarter which means urgent sales requests for security documentation. Well, thanks to Aptible Comply those days are over. Comply Rooms is a completely free, sales enablement tool built specifically for compliance teams to provide immediate, self-serve, and secure access to trust packets. With Rooms you just upload your security docs and NDA, then input your customer's emails to...

April 23, 2021

Prometei botnet exploits Exchange server bugs Facebook wants to 'normalize' the mass scraping of personal data Microsoft 365 outage affects email delivery Thanks to our episode sponsor, Palo Alto Networks In 1666, Sir Isaac Newton famously used a prism to disperse white light into colors. Today, cloud security professionals use Prisma Cloud from Palo Alto Networks to disperse full lifecycle security and full stack protection across their multi- and hybrid-cloud environments. We think Sir Isaac would approve. Learn more about Prisma Cloud at paltoaltonetworks.com/Prisma For the stories behind the headlines, head to CISOseries.com.

Week in Review - April 19-23, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, April 19-23, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, George Finney, CISO, Southern Methodist University Thanks to our episode sponsor, Palo Alto Networks All links and the video of this episode can be found on CISO Series.com

April 22, 2021

EU weighs regulations on "high-risk" AI DOJ forms ransomware task force Facebook disrupts two state-sponsored hacking groups Thanks to our episode sponsor, Palo Alto Networks Ralph Waldo Emerson famously wrote that "It's not the destination, it's the journey." For your cloud security journey, you need a reliable partner. On April 27th, Prisma Cloud by Palo Alto Networks will be hosting Spectrum, a virtual event with sessions to help you create a comprehensive cloud security strategy. Learn more at go.paloaltonetworks.com/spectrum

April 21, 2021

Hundreds of networks reportedly hacked in Codecov supply-chain attack Remote code execution vulnerabilities uncovered in smart air fryer Biden administration unveils plan to defend electric sector from cyberattacks Thanks to our episode sponsor, Palo Alto Networks In Latin, the word "spectrum" means "image". Spectrum also happens to be a cloud security event that's all about container imagesand CI/CD pipeline security, cloud transformation strategies, and much more. Join Prisma Cloud by Palo Alto Networks on April 27 for a virtual event covering all things cloud security. Learn more at go.paloaltonetworks.com/spectrum For the stories behind the headlines, head to CISOseries.com.

April 20, 2021

Security conferences set for in-person return Apple approves Parler's return to the App Store Geico exposed driver's license numbers for months Thanks to our episode sponsor, Palo Alto Networks In 1666, Sir Isaac Newton famously used a prism to disperse white light into colors. Today, cloud security professionals use Prisma Cloud from Palo Alto Networks to disperse full lifecycle security and full stack protection across their multi- and hybrid-cloud environments. We think Sir Isaac would approve. Learn more about Prisma Cloud at paltoaltonetworks.com/Prisma

April 19, 2021

Codecov discloses 2.5-month-long supply chain attack BazarLoader malware aims at Slack and BaseCamp users Windows 10 update causing DNS and shared folder issues Thanks to our episode sponsor, Palo Alto Networks Ralph Waldo Emerson famously wrote that "It's not the destination, it's the journey." For your cloud security journey, you need a reliable partner. On April 27th, Prisma Cloud by Palo Alto Networks will be hosting Spectrum, a virtual event with sessions to help you create a comprehensive cloud security strategy. Learn more at go.paloaltonetworks.com/spectrum For the stories behind the headlines, head to CISOseries.com.

April 16, 2021

US pins SolarWinds attack on Cozy Bear, boots 10 Russian diplomats Second Google Chromium zero-day released on Twitter this week Google rolls out Chrome 90 with HTTPS by default Thanks to our episode sponsor, Sonatype With security concerns around software supply chains ushered to center stage in recent months, organizations around the world are turning to Sonatype as trusted advisors. The company's Nexus platform offers the only full-spectrum control of the cloud-native software development lifecycle including third-party open source code, first-party source code, infrastructure as code, and containerized code.

Week in Review - April 12-16, 2021

Link to Blog Post https://cisoseries.com/cyber-security-headlines-week-in-review-april-12-16-2021 This week's Cyber Security Headlines - Week in Review, April 12-16, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, Davi Ottenheimer, vp, trust and digital ethics, Inrupt. Thanks to our episode sponsor, Sonatype With security concerns around software supply chains ushered to center stage in recent months, organizations around the world are turning to Sonatype as trusted advisors. The company's Nexus platform offers the only full-spectrum control of the cloud-native software development lifecycle including third-party open source code, first-party source code, infrastructure as code, and containerized code. All links and the video of...

April 15, 2021

FBI patches Exchange server backdoors IcedID looks to fill the Emotet malware void Draft plan to improve US power grid security Thanks to our episode sponsor, Sonatype Ask any software developer, and they'll tell you the truth about two things: 1. Conventional code analysis and appsec tools are noisy and not well integrated into the dev workflow. 2: Tools that don't actually make life easier for them just add friction and are ignored. Rather than slowing devs down with process-heavy security gates or circuitous quality alerts, Sonatype believes developers are better served by gentle, timely, and effective nudges that actually...

April 14, 2021

Chrome Zero-Day exploit posted on Twitter April Patch Tuesday patches 114 bugs including NSA's two at 9.8 severity Cyberattacks are the number-one threat to the global financial system, Fed chair says Thanks to our episode sponsor, Sonatype With security concerns around software supply chains ushered to center stage in recent months, organizations around the world are turning to Sonatype as trusted advisors. The company's Nexus platform offers the only full-spectrum control of the cloud-native software development lifecycle including third-party open source code, first-party source code, infrastructure as code, and containerized code. For the stories behind the headlines, head to CISOseries.com.

April 13, 2021

Nvidia announces AI-powered tools for cybersecurity Biden announces nominations for cybersecurity positions Apple updates chip security mid-production Thanks to our episode sponsor, Sonatype Ask any software developer, and they'll tell you the truth about two things: 1. Conventional code analysis and appsec tools are noisy and not well integrated into the dev workflow. 2: Tools that don't actually make life easier for them just add friction and are ignored. Rather than slowing devs down with process-heavy security gates or circuitous quality alerts, Sonatype believes developers are better served by gentle, timely, and effective nudges that actually help them improve the...

April 12, 2021

Israel carries out cyberattack on Iran nuclear facility Joker malware infects over 500,000 Huawei Android devices Critical cloud bug in VMWare Carbon Black allows takeover Thanks to our episode sponsor, Sonatype With security concerns around software supply chains ushered to center stage in recent months, organizations around the world are turning to Sonatype as trusted advisors. The company's Nexus platform offers the only full-spectrum control of the cloud-native software development lifecycle including third-party open source code, first-party source code, infrastructure as code, and containerized code. For the stories behind the headlines, head to CISOseries.com.

April 9, 2021

Office 365 phishing hides behind HTML that stacks up like Legos Tech support scammers sending fake antivirus subscription bills PHP user database leaked in recent Git server attack Thanks to our episode sponsor, Sotero Okay, here's a story that'll warm your heart. A pharmaceutical company was having a really hard time making sensitive data available to downstream systems. Due to their security requirements, they were forced to transfer the data manually, which delayed the data's availability by an entire month. Guess what they did? They turned to our sponsor Sotero to keep the data encrypted as the data is sent...

Week in Review - April 5-9, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, April 5-9, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, Justin Berman, former CISO, Dropbox Thanks to our episode sponsor, Sotero All this week we have been excited to welcome our new sponsor Sotero. We have told you about their encryption solutions that keep data encrypted while the data is in use and in motion. This is the breakthrough that many of us have been waiting for. Well, Sotero has just uploaded to our site a technical whitepaper that takes a deep dive into this...

April 8, 2021

Slack and Discord file sharing used to spread malware Facebook comments on recent user data leak Cring ransomware hits unpatched VPNs Thanks to our episode sponsor, Sotero What could your business do if it could keep data encrypted while the data is in motion or in use? Well, a lot of companies have the answer because they're using a new encryption technology from Sotero. Sotero's data encryption solutions keep data encrypted while the data is in use and in motion. These companies are using Sotero to attract new customers and drive new revenue streams. You really want to check this...

April 7, 2021

European Union institutions targeted in a cyber-attack LinkedIn spearphishing campaign uses custom decoy job offers Ransomware attacks increased by 485% in 2020 over 2019 Thanks to our episode sponsor, Sotero I'm wondering if any of you have had a chance to check out the new data encryption technology from Sotero. Their solutions let you keep data encrypted while the data is in use and in motion. A lot of companies are using Sotero to speed up data analysis, store data in the cloud without giving up the encryption key, and to build in use and in motion encryption into their...

April 6, 2021

Supreme Court rules in Google's favor on Java API case Firmware malware on the rise APTs exploiting vulnerabilities in FortiOS Thanks to our episode sponsor, Sotero In yesterday's Cybersecurity Headlines episode, we told you about an exciting encryption technology from a company called Sotero. They offer data security solutions that encrypt data while the data is in use and in motion. For those of you whose businesses have been held back by the risks of sharing data or storing data in the cloud, you'll want to check them out at Soterosoft.com.

April 5, 2021

533 million Facebook users have personal data leaked online Sierra Wireless resumes production after ransomware attack Malware attack is preventing car inspections in eight US states Thanks to our episode sponsor, Sotero This is a hot data security company with solutions that encrypt data while the data is in motion and in use. This is the breakthrough that everyone's been waiting for. By keeping data encrypted in use and in motion, companies are deploying data in the cloud and to 3rd-party partners and systems with complete confidence. Check them out at Soterosoft.com. For the stories behind the headlines, head to...

April 2, 2021

$3 will get you private webcam feeds sold as home video tapes Ubiquiti attacker tried to extort us, company confirms Crooks offer $500 for work logins, $25/month if they stay valid Thanks to our episode sponsor, Remediant Former Incident Response practitioners Tim Keeler and Paul Lanzi founded Remediant, a leader in Privileged Access Management. They did it to solve the one problem they saw repeatedly - standing administrator privileges. Repeatedly, they saw these rights weaponized by adversaries to deploy ransomware and move laterally across a network. Remediant uniquely addresses the challenge of standing privilege and be a force multiplier to...

Week in Review - March 29-April 2, 2021

Link to Blog Post https://cisoseries.com/cyber-security-headlines-week-in-review-march-29-april-2-2021/ Thanks to our episode sponsor, Remediant Remediant is a fast growing Gartner Cool vendor focused on the concept of precision Privileged Access Management, one that a Fortune 100 company calls "the world's best protection against major incidents." Remediant uniquely: Deploys and inventories thousands of privileged accounts in hours Locks down lateral movement & ransomware spread by removing standing privilege with a single action Administer privileges just-in-time with MFA To learn more, visit remediant.com All links and the video of this episode can be found on CISO Series.com

April 1, 2021

North Korean hackers targeting security researchers Report details data sent from mobile operating systems Does CISA have the resources to succeed? Thanks to our episode sponsor, Remediant Did you know the average large enterprise workstation has 480 admins with 24x7 access to it? This access is called standing privilege and is an adversary's favorite tool and a security team's biggest undiscovered risk. Precision PAM leader Remediant addresses this risk by providing just enough access just in time, eliminating standing privilege with continuous scanning and agentless, vaultless simplicity. To learn more, visit remediant.com

March 31, 2021

Intel sued under wiretapping laws for tracking user activity on its website Whistleblower: Ubiquiti breach "catastrophic" Gibberish tweet from US nuclear-agency was from unattended child Thanks to our episode sponsor, Remediant Remediant is a fast growing Gartner Cool vendor focused on the concept of precision Privileged Access Management and a Fortune 100 company calls "the world's best protection against major incidents." Remediant uniquely deploys & inventories thousands of privileged accounts in hours, locks down lateral movement & ransomware spread by removing standing privilege with a single action, and administers privileges just-in-time with MFA. To learn more, visit remediant.com For the...

March 30, 2021

Emails from DHS officials obtained in SolarWinds hack Docker Hub images contain cryptominers Commits with backdoor pushed to PHP Thanks to our episode sponsor, Remediant Former Incident Response practitioners Tim Keeler and Paul Lanzi founded Remediant, a leader in Privileged Access Management. They did it to solve the one problem they saw repeatedly - standing administrator privileges. Repeatedly, they saw these rights weaponized by adversaries to deploy ransomware and move laterally across a network. Remediant uniquely addresses the challenge of standing privilege and be a force multiplier to Security programs worldwide. To learn more about Tim & Paul's story, watch...

March 29, 2021

Apple releases emergency update for iPhones, iPads, and Apple Watch Android system update may contain spyware Senators offer to let NSA hunt cyber actors inside the US Thanks to our episode sponsor, Remediant Did you know the average large enterprise workstation has 480 admins with 24x7 access to it? This access is called standing privilege and is an adversary's favorite tool and a security team's biggest undiscovered risk. Precision PAM leader Remediant addresses this risk by providing just enough access just in time, eliminating standing privilege with continuous scanning and agentless, vaultless simplicity. To learn more, visit remediant.com For the...

March 26, 2021

Fake COVID credentials flourish on the dark web Mamba ransomware gang abusing open source tools An analysis of COVID-19 vaccine websites Thanks to our episode sponsor, Trend Micro Threat actors want what you're storing in the cloud. Trend Micro's Cloud One platform provides cloud security from a single console, keeping you at your most resilient. Let what happens in the cloud, stay in the cloud.

Week in Review - March 22-26, 2021

Link to Blog Post https://cisoseries.com/cyber-security-headlines-week-in-review-march-22-26-2021/ This week's Cyber Security Headlines - Week in Review, March 22-26, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, Will Lin (@williamlin), managing director & co-founder, ForgePoint Capital Thanks to our episode sponsor, Trend Micro Threat actors want what you're storing in the cloud. Trend Micro's Cloud One platform provides cloud security from a single console, keeping you at your most resilient. Let what happens in the cloud, stay in the cloud. All links and the video of this episode can be found on CISO Series.com

March 25, 2021

Voting information on millions of Israeli's leaked ahead of election Facebook disrupts Chinese group targeting Uyghur community Privacy and security issues with Slack's Connect DM rollout Thanks to our episode sponsor, Trend Micro Threat actors want what you're storing in the cloud. Trend Micro's Cloud One platform provides cloud security from a single console, keeping you at your most resilient. Let what happens in the cloud, stay in the cloud.

March 24, 2021

US government calls for better information sharing in wake of SolarWinds, Exchange attacks Hospitals hide pricing data from search results New Android zero-day vulnerability Is under active attack Thanks to our episode sponsor, Trend Micro Threat actors want what you're storing in the cloud. Trend Micro's Cloud One platform provides cloud security from a single console, keeping you at your most resilient. Let what happens in the cloud, stay in the cloud. For the stories behind the headlines, head to CISOseries.com.

March 23, 2021

SCOTUS: Facebook's still on the hook for nonconsensual user tracking Democrats prepare swarm of antitrust bills targeting Big Tech Microsoft Exchange servers flooded with ransomware Thanks to our episode sponsor, Trend Micro Threat actors want what you're storing in the cloud. Trend Micro's Cloud One platform provides cloud security from a single console, keeping you at your most resilient. Let what happens in the cloud, stay in the cloud.

March 22, 2021

REvil Ransomware gang demands $50 million from Acer Feds indict hacktivist behind Verkada surveillance camera breach SolarWinds-linked hacking group SilverFish abuses enterprise victims for sandbox tests Thanks to our episode sponsor, Trend Micro Threat actors want what you're storing in the cloud. Trend Micro's Cloud One platform provides cloud security from a single console, keeping you at your most resilient. Let what happens in the cloud, stay in the cloud. For the stories behind the headlines, head to CISOseries.com.

March 19, 2021

Over $4.2 billion in cybercrime losses reported to FBI in 2020 Fake iPhone charger blows up in researcher's face Taxpayers attacked with Trojan-inflicting phishing campaign Thanks to our episode sponsor, Trend Micro The conversation between you and your board of directors is not always a walk in the park. With more cloud projects coming your way, it's time to change the conversation to speak their language and start paving the way for a secure future. For more, go to http://trendmicro.com/CISO

Week in Review - March 15-19, 2021

Link to Blog Post Cyber Security Headlines Week in Review, March 15-19, 2021, is hosted bySteve Prentice(@stevenprentice) with our guest,Jesse Whaley, CISO,Amtrak Thanks to our episode sponsor, Trend Micro The conversation between you and your board of directors is not always a walk in the park. With more cloud projects coming your way, it's time to change the conversation to speak their language and start paving the way for a secure future. For more, go to http://trendmicro.com/CISO All links and the video of this episode can be found on CISO Series.com

March 18, 2021

Telcos targeted by Chinese attackers Mimecast source code stolen by SolarWinds attackers Hiding data in Twitter images Thanks to our episode sponsor, Trend Micro The conversation between you and your board of directors is not always a walk in the park. With more cloud projects coming your way, it's time to change the conversation to speak their language and start paving the way for a secure future. For more, go to http://trendmicro.com/CISO

March 17, 2021

Microsoft shares one-click ProxyLogon mitigation tool for Exchange servers Microsoft Teams, Exchange and more went down for four hours on Monday Signal is down in China after 100 million reported downloads Thanks to our episode sponsor, Trend Micro The conversation between you and your board of directors is not always a walk in the park. With more cloud projects coming your way, it's time to change the conversation to speak their language and start paving the way for a secure future. For more, go to http://trendmicro.com/CISO For the stories behind the headlines, head to CISOseries.com.

March 16, 2021

Cyber criminals impacted by OVH data center fire Journalist hit with $16 SMS attack Hackers steal NFTs Thanks to our episode sponsor, Trend Micro The conversation between you and your board of directors is not always a walk in the park. With more cloud projects coming your way, it's time to change the conversation to speak their language and start paving the way for a secure future. For more, go to http://trendmicro.com/CISO

March 15, 2021

DearCry ransomware using ProxyLogon exploits Google faces suit over snooping on "Incognito" browsing Detecting deepfakes by analyzing light reflections in the eyes Thanks to our episode sponsor, Trend Micro The conversation between you and your board of directors is not always a walk in the park. With more cloud projects coming your way, it's time to change the conversation to speak their language and start paving the way for a secure future. For more, go to http://trendmicro.com/CISO For the stories behind the headlines, head to CISOseries.com

March 12, 2021

Raided phone network Sky ECC says no, police didn't break our encryption 'Even 20-year-old interns' could watch unsecured webcam feeds Russia blocks itself by mistake Thanks to our episode sponsor, Trend Micro With organizations rapidly migrating to the cloud, CISOs have new challenges to address. Trend Micro Cloud One is a connected SaaS platform comprised of six solutions that address all your cybersecurity needs from workloads, to file storage, containers and more. Empower your IT teams to do more with less with Trend Micro Cloud One. Visit us at Trendmicro.com for more info.

Week in Review - March 8-12, 2021

Link to Blog Post https://cisoseries.com/cyber-security-headlines-week-in-review-march-8-12 This week's Cyber Security Headlines - Week in Review, March 8-12, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, Dan Walsh, CISO, VillageMD Thanks to our episode sponsor, Trend Micro With organizations rapidly migrating to the cloud, CISOs have new challenges to address. Trend Micro Cloud One(tm) is a connected SaaS platform comprised of six solutions that address all your cybersecurity needs from workloads, to file storage, containers and more. Empower your IT teams to do more with less with Trend Micro Cloud One. Visit us at Trendmicro.com for more info. All links...

March 11, 2021

Cloud hosting data centers burn down New initiative hopes to secure the open source supply chain Dependency confusion attacks flourishing Thanks to our episode sponsor, Trend Micro With organizations rapidly migrating to the cloud, CISOs have new challenges to address. Trend Micro Cloud One is a connected SaaS platform comprised of six solutions that address all your cybersecurity needs from workloads, to file storage, containers and more. Empower your IT teams to do more with less with Trend Micro Cloud One. Visit us at Trendmicro.com for more info.

March 10, 2021

Microsoft March Patch Tuesday fixes 82 flaws, 2 zero-days Hackers access surveillance cameras at Tesla, Cloudflare, banks, more CISA urges people get serious about Exchange Server exploitation Thanks to our episode sponsor, Trend Micro With organizations rapidly migrating to the cloud, CISOs have new challenges to address. Trend Micro Cloud One is a connected SaaS platform comprised of six solutions that address all your cybersecurity needs from workloads, to file storage, containers and more. Empower your IT teams to do more with less with Trend Micro Cloud One. Visit us at Trendmicro.com for more info. For the stories behind the...

March 9, 2021

SUPERNOVA malware linked to threat actor Spiral Intel working on FHE silicon Gender disparity remains an issue in cyber security Thanks to our episode sponsor, Trend Micro With organizations rapidly migrating to the cloud, CISOs have new challenges to address. Trend Micro Cloud One is a connected SaaS platform comprised of six solutions that address all your cybersecurity needs from workloads, to file storage, containers and more. Empower your IT teams to do more with less with Trend Micro Cloud One. Visit us at Trendmicro.com for more info.

March 8, 2021

REvil ransomware gang uses extended voice calls to pressure victims New Microsoft tool checks Exchange Servers for ProxyLogon hacks Ongoing phishing attacks target US brokers with fake FINRA audits Thanks to our episode sponsor, Trend Micro With organizations rapidly migrating to the cloud, CISOs have new challenges to address. Trend Micro Cloud One is a connected SaaS platform comprised of six solutions that address all your cybersecurity needs from workloads, to file storage, containers and more. Empower your IT teams to do more with less with Trend Micro Cloud One. Visit us at Trendmicro.com for more info. For the stories...

March 5, 2021

Fake (right-wing) news does better than real news on Facebook Security firm Qualys says it was victimized in Accelion zero-day CISA issues emergency 'fix Exchange zero-days NOW!' directive Thanks to our episode sponsor, TrustMAPP The last audit firm that assessed your security compliance did the interviews, wrote a report, and then left. That's just half the job. Now you have to identify maturity gaps, cost out and prioritize remediations, and track improvement over time. That's where TrustMAPP comes in.

Week in Review | March 1-5, 2021

Link to Blog Post https://cisoseries.com/cyber-security-headlines-week-in-review-march-1-5-2021 This week's Cyber Security Headlines - Week in Review, March 1-5, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, John Overbaugh (@johnoverbaugh), vp, security, CareCentrix Thanks to our episode sponsor, TrustMAPP Maturity Assessment, Profile, and Plan Learn the MAPP methodology for managing security as a business. While the information security industry has undergone convulsive change, it is coalescing around maturity-based management of key business processes. The MAPP approach provides practical implementation of the maturity model. This paper describes a three-step maturity-centric approachMaturity Assessment, a Profile, and a Plan (MAPP). An information security MAPP...

March 4, 2021

Virginia's Consumer Data Protection Act signed into law Exchange Server zero-days exploited in the wild Facebook to lift political ad ban Thanks to our episode sponsor, TrustMAPP Does your board want to see yet more heat maps? No, they do not. They want to see that security investments align with business goals, and that their costs are objectively justified. TrustMAPP's data visualization helps you communicate with your board in a way they can understand and approve.

March 3, 2021

Microsoft announces end-to-end encryption support for Teams, plus passwordless logins U.S. unprepared for AI competition with China, commission finds Tom Cruise deepfake videos rattle security experts Thanks to our episode sponsor, TrustMAPP Are you a vCISO? Building your practice and client base is hard enough don't waste time building the tools you need to operate. TrustMAPP's turnkey SaaS platform gets you up and running quickly, so you can focus on your business. For the stories behind the headlines, head to CISOseries.com.

March 2, 2021

Gab user data leaked Biden administration to keep tech export ban rules Hackers give websites great SEO before installing malware Thanks to our episode sponsor, TrustMAPP First it was GDRP in the EU, then California's CCPA. Now Virginia is set to pass its own Consumer Data Protection Act. Are you ready? Get ready with TrustMAPP.

March 1, 2021

Ryuk ransomware now self-spreads to other Windows LAN devices Go malware sees 2000% increase, adopted by APTs and e-crime groups Former SolarWinds CEO blames intern for 'solarwinds123' password leak Thanks to our episode sponsor, TrustMAPP Attention defense contractors! Are you ready for CMMC? TrustMAPP addresses your CMMC and NIST 800-171 maturity and compliance assessments needs today, and automatically builds a roadmap to achieve your desired level of maturity posture. For more information, visit TrustMAPP.com For the stories behind the headlines, head to CISOseries.com.

February 26, 2021

Biden orders review of supply chain security China uses malicious Firefox Extension to spy on Tibetans Attackers scan for unpatched VMware servers after PoC exploit release Thanks to our episode sponsor, PlexTrac PlexTrac is the Purple Teaming Platform. Use the Runbooks Module to facilitate your tabletop exercises, red team engagements, breach and attack simulations, and pentest automation to improve communication and collaboration. PlexTrac upgrades your program's capabilities by making the most of every team member and tool. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs!

Week in Review | February 22 through 26, 2021

Link to Blog Post This week'sCyber Security Headlines Week in Review, February 22-26, 2021, is hosted bySteve Prentice(@stevenprentice) with our guest,Naomi Buckwalter(@ineedmorecyber), director of information security and IT,Beam Technologies Please join us live every Thursday at 4pm PT/7pm ET by registering for the open discussion. Thanks to our episode sponsor, PlexTrac PlexTrac is the solution to deal with your data. Aggregate findings from all assessments to produce the analytics needed to make informed decisions. Produce data visualizations and add them to reports with one click to communicate effectively to leadership. PlexTrac is the premier product for security data management. Check...

February 25, 2021

Microsoft and FireEye push for breach reporting rules US Federal Reserve hit with massive IT outage Path cleared for California's net neutrality law Thanks to our episode sponsor, PlexTrac Solve your talent shortage with PlexTrac. Use PlexTrac to automate security tasks and workflows to keep your red, blue, and purple teams focused on the real security work. Gain precious time back in your team's day and improve their morale by making them more effective with PlexTrac. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs!

February 24, 2021

Most firms now fear nation state attack Firefox 86 gets privacy boost with Total Cookie Protection Shadow attacks let attackers replace content in digitally signed PDFs Thanks to our episode sponsor, PlexTrac PlexTrac is the solution to deal with your data. Aggregate findings from all assessments to produce the analytics needed to make informed decisions. Produce data visualizations and add them to reports with one click to communicate effectively to leadership. PlexTrac is the premier product for security data management. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs! For the stories behind the headlines, head...

February 23, 2021

SHAREit fixes security holes Organizations feel the impact of the Accellion exploit China spyware cribs the NSA Thanks to our episode sponsor, PlexTrac Gain a real-time view of security posture with PlexTrac by consolidating scanner findings, assessments, and bug bounty tools. Visualize your posture in the Analytics Module to quickly assess and prioritize, creating a more effective workflow. Map risks to the MITRE ATT&CK framework to create a living risk register. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs!

February 22, 2021

Silver Sparrow malware found on 30,000 Macs has security pros stumped SolarWinds hackers stole source code for Microsoft Azure, Exchange, Intune New hack lets attackers bypass MasterCard PIN by using it as Visa card Thanks to our episode sponsor, PlexTrac PlexTrac is a powerful, yet simple, cybersecurity platform that centralizes all security assessments, pentest reports, audit findings, and vulnerabilities. PlexTrac transforms the risk management lifecycle, allowing security professionals to generate better reports faster, aggregate and visualize analytics, and collaborate on remediation in real-time. Check out PlexTrac.com/CISOSeries to learn why PlexTrac is the perfect platform for CISOs! For the stories behind...

February 19, 2021

Dating-app video calls could have been spied on Microsoft pulls buggy Windows update that blocked security updates Windows, Linux servers targeted by new WatchDog botnet Thanks to our episode sponsor, Kenna Security Ready to shift gears to risk-based vulnerability management? Now's the time. Through Kenna Security's on-demand educational series Kenna Katalyst, you can learn the six steps needed to start your own risk-based vulnerability management program and make vulnerability management well, more manageable. And you can earn 1 CPE credit through (ISC). Learn more at kennasecurity.com/katalyst.

Week in Review | February 15 through 19, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, February 15-19, 2021, is hosted by Steve Prentice (@stevenprentice) with our guest, Mike Johnson, co-Host CISO Vendor Relationship Podcast. Thanks to our episode sponsor, Kenna Security In just one hour, learn how to prioritize your riskiest vulnerabilities and lower your cyber risk through Kenna Katalyst, the newest on-demand educational series from Kenna Security designed to kickstart your risk-based vulnerability management program and equip you with expert tips you can implement today. Backed by (ISC), participants can earn 1 CPE credit. Start now at kennasecurity.com/katalyst. All links and...

February 18, 2021

SolarWinds attack launched from within the US Facebook restricts Australian news sharing Security researcher finds native Apple Silicon malware Thanks to our episode sponsor, Kenna Security Ready to shift gears to risk-based vulnerability management? Now's the time. Through Kenna Security's on-demand educational series Kenna Katalyst, you can learn the six steps needed to start your own risk-based vulnerability management program and make vulnerability management well, more manageable. And you can earn 1 CPE credit through (ISC). Learn more at kennasecurity.com/katalyst.

February 17, 2021

Security bugs left unpatched in Android app with one billion downloads LastPass will restrict free users to only one type of device starting next month North Korea accused of hacking Pfizer for Covid-19 vaccine data Thanks to our episode sponsor, Kenna Security In just one hour, learn how to prioritize your riskiest vulnerabilities and lower your cyber risk through Kenna Katalyst, the newest on-demand educational series from Kenna Security designed to kickstart your risk-based vulnerability management program and equip you with expert tips you can implement today. Backed by (ISC), participants can earn 1 CPE credit. Start now at kennasecurity.com/katalyst....

February 16, 2021

France links Russian Sandworm hackers to hosting provider attacks Privacy problems with Azure and Canonical Microsoft estimates thousands of developers touched SolarWinds malware Thanks to our episode sponsor, Kenna Security Kenna Katalyst is Kenna Security's newest on-demand educational series designed to help you shift gears to risk-based vulnerability management. Get the six key steps you need to go risk-based along with actionable tips to help your team focus on the risks that matter most. Participants can earn 1 CPE credit through (ISC). Learn more at kennasecurity.com/katalyst.

February 15, 2021

SuperMicro supply chain hack used for counterintelligence for a decade Egregor ransomware operators arrested in Ukraine Scammers target US tax pros in ongoing IRS phishing attacks Thanks to our episode sponsor, Kenna Security Ready to shift gears to risk-based vulnerability management? Now's the time. Through Kenna Security's on-demand educational series Kenna Katalyst, you can learn the six steps needed to start your own risk-based vulnerability management program and make vulnerability management well, more manageable. And you can earn 1 CPE credit through (ISC). Learn more at kennasecurity.com/katalyst. For the stories behind the headlines, head to CISOseries.com

February 12, 2021

Pitiful password enabled recent water treatment facility hack Border patrol scans millions of faces, catches 0 imposters at airports India using a glitchy app to inoculate 300 million people by August Thanks to our episode sponsor Altitude Networks Wouldn't it be great if you could INSTANTLY KNOW if a file containing sensitive information was shared in the wrong way, anywhere in your company AND security had a real time slack notification with a magic "undo button"?! Altitude Networks solves these challenges and protects you from all data leak risks on G Suite and Office 365! Check it out at AltitudeNetworks.com...

Week in Review | February 8 through 12, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, February 8-12, 2021 is hosted by Steve Prentice (@stevenprentice) with our guest, Johna Till Johnson (@JohnaTillJohnso), CEO, Nemertes Research. Thanks to our episode sponsor,Altitude Networks Imagine an employee just left and went to a competitor: did they take proprietary documents or critical roadmaps with them? Did they add a backdoor access via personal accounts to documents? You're a cloud-forward company on G Suite, how would you know your data is at risk? Altitude Networks can automatically tell you who is trying to steal your critical cloud data...

February 11, 2021

SIM swapping gang targeting celebrities arrested Researcher demonstrates the vulnerability of open source to supply chain attacks Google study looks at high-risk victims of email attacks Thanks to our episode sponsor Altitude Networks "Uh oh! Charles just accidentally shared the board deck by link on the company slack channel and the link is open to all employees! I hope we can take it down before the M&A information leaks!" Does this scenario sound familiar? Make sure it doesn't happen at your company!! Altitude Networks provides always-on data security for GSuite and Office365. Check it out at AltitudeNetworks.com and be sure...

February 10, 2021

Office 365 will help admins find impersonation attack targets U.S. agencies publish ransomware factsheet Europol busts international cybercriminal group Thanks to our episode sponsor Altitude Networks Imagine an employee just left and went to a competitor: did they take proprietary documents or critical roadmaps with them? Did they add a backdoor access via personal accounts to documents? You're a cloud-forward company on G Suite, how would you know your data is at risk? Altitude Networks can automatically tell you who is trying to steal your critical cloud data from G Suite and Office 365. Check it out at AltitudeNetworks.com and...

February 9, 2021

A look at Iranian spyware operations Florida water treatment plant hacked to distribute harmful chemicals Microsoft to add 'nation-state activity alerts' to Defender Thanks to our episode sponsor Altitude Networks Remember that time when someone at work accidentally shared a Google document to your personal email? Well, that happens a lot and it leaves a backdoor to cloud data for former employees or contracts. Altitude Networks is the only solution that will protect you from this and many other data leak risks on G Suite and Office 365! Check it out at AltitudeNetworks.com and be sure your sensitive data isn't...

February 8, 2021

New phishing attack uses Morse code to hide malicious URLs Hacked by SolarWinds, Mimecast lays off staff despite record profits Activists complain of weakened voting security standard Thanks to our episode sponsor Altitude Networks Uh oh, Johnny left the company 6 months ago, but still has access to numerous files in Google Drive via his personal account! Do you know how many other former employees and contractors still have access to our documents? It's a lot more than you might think. Altitude Networks automatically discovers sharing to personal accounts and can eliminate it with one click. Check it out at...

February 5, 2021

Canada calls Clearview AI's facial recognition 'mass surveillance' Amazon pulls Big-Brother move, puts AI cameras in delivery vans Myanmar blocks Facebook following military coup Thanks to our episode sponsor HID Global: Evolving organizations need strong MFA. With the broadest selection of authentication options in the industry, HID Global's advanced multi-factor authentication solution is capable of building a frictionless user experience that blends convenience and protection. Learn more at www.hidglobal.com/mfa

Week in Review: February 1 through 5, 2021

Link to Blog Post This week's Cyber Security Headlines - Week in Review, February 1-5, 2021 is hosted by Steve Prentice (@stevenprentice) with our guest, Shawn Bowen, CISO,RestaurantBrandsInternational(RBI) Thanks to our episode sponsor HID Global Evolving organizations need strong MFA. With the broadest selection of authentication options in the industry, HID Global's advanced multi-factor authentication solution is capable of building a frictionless user experience that blends convenience and protection. Learn more at www.hidglobal.com/mfa All links and the video of this episode can be found on CISO Series.com

February 4, 2021

Microsoft sees a rise in business email compromise attacks on schools Facebook takes a proactive content stance after Myanmar coup SolarWinds CEO says its email systems were compromised for months Thanks to our episode sponsor HID Global: Evolving organizations need strong MFA.With the broadest selection of authentication options in the industry, HID Global's advanced multi-factor authentication solution is capable of building a frictionless user experience that blends convenience and protection. Learn more atwww.hidglobal.com/mfa

February 3, 2021

Another SolarWinds vulnerability used to hack National Finance Center SonicWall confirms actively exploited zero-day Microsoft Defender now detects macOS vulnerabilities Thanks to today's sponsors, HID Global: Evolving organizations need strong MFA.With the broadest selection of authentication options in the industry, HID Global's advanced multi-factor authentication solution is capable of building a frictionless user experience that blends convenience and protection. Learn more atwww.hidglobal.com/mfa

February 2, 2021

Deloitte's CDC vaccine system comes up short Myanmar internet and telecom disruptions continue due to coup Sprite Spider emerges as one of the most destructive ransomware threat actors this year Thanks to our sponsor, HID Global Evolving organizations need strong MFA. With the broadest selection of authentication options in the industry, HID Global's advanced multi-factor authentication solution is capable of building a frictionless user experience that blends convenience and protection. Learn more at https://hidglobal.com/mfa For the stories behind the headlines, head to CISOseries.com.

February 1, 2021

Suspected Russian hack extends far beyond SolarWinds software Russian hack brings changes and uncertainty to US court system Section 230 emerges as Robinhood's shield from lawsuits Evolving organizations need strong MFA. With the broadest selection of authentication options in the industry, HID Global's advanced multi-factor authentication solution is capable of building a frictionless user experience that blends convenience and protection. Learn more at https://hidglobal.com/mfa. For the stories behind the headlines, head to CISOseries.com.

January 29, 2021

Unhappy #DataPrivacyDay to us all WhatsApp adds biometric authentication to web, desktop versions Sources: Facebook preps suit against Apple over App Store rules And now our sponsor Nucleus Security brings you "The Top 5 Antipatterns in Vulnerability Management": Antipattern #4: "Homegrown Vulnerability Management Tools":Large enterprises are full of homegrown vulnerability management tools that were abandoned due to complexity or cumbersome builds. See how Nucleus automates your vulnerability management workflows, replacing the need for custom tools completely, atnucleussec.com/demo

Week in Review: January 25 through 29, 2021

Link to Blog Post This week's Cyber Security Headlines Week in Review, January 25-29, 2021, is hosted by Steve Prentice @stevenprentice with our guest, Steve Zalewski, Deputy CISO, Levi Strauss. Thanks to our sponsor, Nucleus Security All this week on our daily news podcast, Nucleus Security has been sharing some antipatterns in vulnerability management, such as relying on spreadsheets to track risks, relying on homegrown vulnerability management tools that were abandoned due to complexity or cumbersome builds, and the challenge of hiring enough vulnerability analysts to do triage. Learn how Nucleus can rescue you from these types of challenges and...

January 28, 2021

10-year old sudo bug patched Mass Emotet uninstall planned for March 25th Microsoft's security business exceeds $10 billion in revenue And now our sponsor Nucleus Security brings you "The Top 5 Antipatterns in Vulnerability Management": Antipattern #4: "Homegrown Vulnerability Management Tools":Large enterprises are full of homegrown vulnerability management tools that were abandoned due to complexity or cumbersome builds. See how Nucleus automates your vulnerability management workflows, replacing the need for custom tools completely, atnucleussec.com/demo

January 27, 2021

Google's Threat Analysis Group warns of social engineering hack aimed at security researchers Verizon outage started in Brooklyn TikTok fixes flaws allowing theft of private user information And now our sponsor Nucleus Security brings you "The Top 5 Antipatterns in Vulnerability Management": Antipattern #3: "The Army of Analysts": Manual vulnerability analysis doesn't scale. In large enterprises, it's impossible to hire enough vulnerability analysts to manually analyze and triage vulnerability scan results fast enough. Learn how Nucleus automates vulnerability analysis and triage with a demo-on-demand at nucleussec.com/demo. For the stories behind the headlines, head to CISOseries.com.

January 26, 2021

Google's cookie replacement performs well in tests Twitter Birdwatch pilot launches WhatsApp wormable malware found on Android And now our sponsor Nucleus Security brings you "The Top 5 Antipatterns in Vulnerability Management": Antipattern #2: "CVSS prioritization": CVSS scores are useful, but you need much more than scores to determine what to fix and when to fix it; Business context and vulnerability intelligence are key to prioritizing vulnerabilities in large enterprises. Learn how Nucleus can help with intelligent vulnerability prioritization at nucleussec.com/demo

January 25, 2021

President Biden takes on cybersecurity on day one SonicWall firewall maker hacked using zero-day in its VPN device Intel probes reports of quarterly earnings hack And now our sponsor Nucleus Security brings you "The Top 5 Antipatterns in Vulnerability Management": Antipattern No. 1: "Spreadsheet Hell": Relying on Microsoft Excel to track risks and answer questions about your vulnerability data is inefficient and insecure. Learn how Nucleus can rescue you from spreadsheet hell and provide the data insights you need with a demo-on-demand at nucleussec.com/demo.

January 22, 2021

Technologists comb through Parler videos with facial recognition EU privacy watchdogs go after employers who spy on workers Google investigates top AI ethicist's exfiltration of thousands of files Thanks to our episode sponsor Armis Armis research shows that on average, companies are blind to 40% of the devices in their environment. This blind spot includes traditional desktops, laptops, cloud and virtual instances, BYOD, and IoT and more. Without a real-time, comprehensive view of all these assets or the risks associated with them, businesses are vulnerable. Armis Asset Management can help by providing 5x more visibility over exciting solutions.

Week in Review: January 18 through 22, 2021

Link to Blog Post This week's Cyber Security Headlines Week in Review, January 18-22, 2021 is hosted by Steve Prentice @stevenprentice with our guest Joshua Scott, Head of Information Security at Postman. Thanks to our episode sponsor Armis Armis has research shows that on average, companies are blind to 40% of the devices in their environment. This blind spot includes traditional desktops, laptops, cloud and virtual instances, BYOD, and IoT and more. Without a real-time, comprehensive view of all these assets or the risks associated with them, businesses are vulnerable. Armis Asset Management can help by providing 5x more visibility...

January 21, 2021

Malwarebytes breached by the group that attacked Solarwinds Google researcher finds security flaws impacting popular chat apps Executive Order addresses malicious use of public clouds Thanks to our episode sponsor Armis Armis research shows that on average, companies are blind to 40% of the devices in their environment. This blind spot includes traditional desktops, laptops, cloud and virtual instances, BYOD, and IoT and more. Without a real-time, comprehensive view of all these assets or the risks associated with them, businesses are vulnerable. Armis Asset Management can help by providing 5x more visibility over exciting solutions. For more on any of...

January 20, 2021

FireEye releases report and network auditing tool for SolarWinds-type hacks SolarWinds malware arsenal widens with Raindrop DNSpooq bugs let attackers hijack DNS on millions of devices Thanks to our episode sponsor Armis One of the biggest challenges security teams face is they do not have a clear picture of all assets in their environment. The resulting 'blind spot' means they have no way to efficiently, credibly, and automatically manage security. Armis Asset Management eliminates this blind spot providing 5X more visibility than other solutions. Head over to armis.com to learn more. For more on any of these stories, head to...

January 19, 2021

Parler resurfaces online Darknet forum Joker's Stash shutting down Microsoft Defender to enable auto-remediation by default Thanks to our episode sponsor Armis All cybersecurity programs start with gaining full visibility into all the assets in the environment. Yet security teams continue to struggle to see every thing they have. This asset blind spot means security teams don't have an accurate picture of what needs to be managed and secured. Head over to armis.com to see how Armis Asset Management helps you overcome this Cybersecurity Asset Management challenge. For more on any of these stories, head to cisoseries.com

January 18, 2021

Xiaomi added to Pentagon blacklist Dating apps are using images from the siege to ban rioters' accounts NSA suggests enterprises use designated DNS-over-HTTPS resolvers Thanks to our episode sponsor Armis Lack of complete visibility to all assets in any environment is a huge cybersecurity challenge for every organization. And fragmentation across tools and systems along with broken remediation makes Cybersecurity Asset Management near impossible. Armis Asset Management addresses this issue providing 5X the visibility of other solutions in the market today. Download our white paper today. For more on any of these stories, head to cisoseries.com

January 15, 2021

Hackers waltzed past MFA used by CISA on cloud accounts Social media convulses after Capitol attack Google fixes bug that delayed COVID contact-tracing apps Thanks to our episode sponsor, IT Asset Management Group Are you checking your IT asset disposal vendor's homework? Organizations should record unique IDs of each asset disposed of and reconcile their records against the data that is provided by their disposal vendor. This practice reduces exposures that can occur from poorly monitored data disposition events. You can learn more tips like this from IT Asset Management Group's free data disposition program guide. Download the program guide...

Week in Review: January 11 through 15, 2021

Link to blog post This week's Cyber Security Headlines Week in Review, January 11-15, 2021 is hosted by Steve Prentice @stevenprentice with our guest Allan Alford, @AllanAlfordinTX. Thanks to our episode sponsor, IT Asset Management Group Organizations must have adequate written policies and procedures to meet the regulatory requirements for the disposal of their retired data containing devices. These policies should be readily available and regularly reviewed by leadership. IT Asset Management Group offers a free policy template to help establish or improve your written policies for IT asset disposal practices. Download the policy template today atitamg.com/CISO All links and...

January 14, 2021

Europol confirms dark web marketplace takedown Google to reportedly block all political ads... again DoD halts deployment of cybersecurity system Thanks to our episode sponsor, IT Asset Management Group Are you checking your IT asset disposal vendor's homework? Organizations should record unique IDs of each asset disposed of and reconcile their records against the data that is provided by their disposal vendor. This practice reduces exposures that can occur from poorly monitored data disposition events. You can learn more tips like this from IT Asset Management Group's free data disposition program guide. Download the program guide today atitamg.com/CISO For more...

January 13, 2021

Hackers leak stolen Pfizer COVID-19 vaccine data online Social media's big terrible week Parler archived due to "mind-numbing" mistake Thanks to our episode sponsor, IT Asset Management Group Poorly managed IT asset disposal, lack of due diligence, and a disposal program without clearly defined responsible parties has now resulted in millions of dollars in regulatory penalties. Is it clear who is responsible for the performance of your data disposition practice? IT Asset Management Group's free program guide includes tips for establishing stakeholders at your organization and expectations for all practitioners. Download the program guide today atitamg.com/CISO For more on any...

January 12, 2021

SolarWinds breach now linked to Turla UK ruling limits the reach of "general warrants" UN data breach exposes staff records Thanks to our episode sponsor, IT Asset Management Group How does your organization measure a successful IT asset disposal program? Are decisions driven by dollars saved, ease of use, or security and compliance risk reduction? You should not have to choose one over the other. Utilizing IT Asset Management Group's best practices guide will ensure your data disposition program performs for all stakeholders in your organization. Download the program guide today atitamg.com/CISO For more on any of these stories, head...

January 11, 2021

Parler removed from Apple, Google, and Amazon Facial-recognition app Clearview sees a spike in use after Capitol attack Emotet tops malware charts in December after reboot Thanks to our episode sponsor, IT Asset Management Group Organizations must have adequate written policies and procedures to meet the regulatory requirements for the disposal of their retired data containing devices. These policies should be readily available and regularly reviewed by leadership. IT Asset Management Group offers a free policy template to help establish or improve your written policies for IT asset disposal practices. Download the policy template today atitamg.com/CISO For more on any...

January 8, 2021

Our sponsor, Omada's identity governance tip of the day Deploy identity capabilities in phases. If you try to do a massive lift and shift problems will occur and it will probably take longer than you expect. See where you can add value early on. First, launch the solution's basic functionality. What can be done without writing custom code? Where you can deliver value at each iteration? You want to show continuous success rather than the fastest total completion time. Learn more at omada.net. For links to the full stories, head over to CISOseries.com.

Week in Review: January 4 through 8, 2021

Link to Blog Post This week's Cyber Security Headlines Week in Review - January 4-8, 2021 is hosted by Steve Prentice, with our guest, Ross Young, CISO, Caterpillar Financial (LinkedIn). Thanks to our episode sponsor, Omada Get stakeholders on board early. Sounds simple, but the hard part is making sure everyone has the right level of information they need at the right time to do their job. So start thinking early about the needs of your CISO, the security staff, auditors, compliance officers, and intellectual property controllers. The goal is increased awareness for all which will reduce resistance for everyone....

January 7, 2021

Rioters storm US Capitol, Trump's Twitter suspended SolarWinds attackers accessed DOJ's email server WhatsApp to share user data with Facebook Our sponsor, Omada's identity governance tip of the day According to Gartner, if you use a SaaS solution for identity governance and administration you'll save an average of 30 percent in initial integration costs. Here are some items to look for when choosing an IGA SaaS solution: Does it have high availability? Is it configurable to your specific business needs and can that be transferred to a tiered deployment environment? Learn more tricks to managing identity in the cloud at...

January 6, 2021

Google, Alphabet employees unionize NYSE no longer plans to de-list Chinese firms Amazon banned from using AWS trademark in China Our sponsor, Omada's identity governance tip of the day Upon launching a project map your business priorities to best-practice identity processes. Then, perform a fit-gap analysis between functional areas in the process to the ideal goal. Where are key data and systems going? Where are there gaps? Are there deviations from best practices? You now have a blueprint of business processes and gaps. Knowing is half the battle. Let Omada help by visiting them at omada.net. For links to the...

January 5, 2021

Microsoft source code accessed by SolarWinds attackers Slack suffers massive outage UK judge denies Assange extradition to US Our sponsor, Omada's identity governance tip of the day Well-tested process frameworks are great starting points. No need to reinvent. Just tweak processes that have already proven effective such as automating identity management, access requests, cross-application segregation of duties, and least privilege access. Head over to omada.net to see how Omada can help you get two steps ahead with your identity management. For links to the full stories, head over to CISOseries.com.

January 4, 2021

Russian SolarWinds hack damage escalates Backdoor account discovered in more than 100,000 Zyxel firewalls and VPN gateways Wall Street to kick out Chinese telecom giants Our sponsor, Omada's identity governance tip of the day Get stakeholders on board early. Sounds simple, but the hard part is making sure everyone has the right level of information they need at the right time to do their job. So start thinking early about the needs of your CISO, the security staff, auditors, compliance officers, and intellectual property controllers. The goal is increased awareness for all which will reduce resistance for everyone. Discover how...

December 31, 2020

T-Mobile discloses data breach CISA updates SolarWinds guidance Emotet strikes Lithuanian health infrastructure Thanks to our sponsor ReversingLabs Newly created digital data that supports productivity is growing greater than forty percent annually. With more employees working remote and businesses reliant on this digital content, what steps are you taking to ensure this data is secure? Learn more about how ReversingLabs can help establish secure digital business processes today and watch an on-demand demo at reversinglabs.com/demo. For the stories behind the headlines, head to CISOseries.com.

December 30, 2020

Google Docs bug exposes users private documents Kawasaki discloses security breach, potential data leak Brexit deal warns of security dangers of Netscape Communicator Thanks to our sponsor ReversingLabs We've seen a 430% growth in next generation cyber attacks actively targeting open-source software projects. Worse yet, contemporary malware implements evasive techniques to avoid detection by AV and Sandbox technologies. What can you do to stay on top of these new threats? Learn more about how ReversingLabs can help your software development teams today and watch an on-demand demo at reversinglabs.com/demo. For the stories behind the headlines, head to CISOseries.com.

December 29, 2020

Defending the COVID-19 vaccine supply chain Cellular aggregation tool detailed in police records CISA releases malware detection tool for Azure and Microsoft 365 Thanks to our sponsor ReversingLabs The SolarWinds attack has highlighted the need to scan "gold" software images prior to their release or consumption, and look for software tampering, invalid digital signing, and build quality issues. Do you have the right controls in place to assess these risks? Learn more about how ReversingLabs can help your security and release teams today and watch an on-demand demo at reversinglabs.com/demo. For the stories behind the headlines, head to CISOseries.com.

December 28, 2020

Microsoft resellers seen as Russian cyberattack mules GoDaddy employees fail holiday bonus phishing test SolarWinds releases updated advisory for new SUPERNOVA malware Thanks to our sponsor ReversingLabs Less than thirty percent of organizations have a formal threat hunting program, yet threat hunting has shown to improve overall security postures by over ten percent. What actions are you taking to upskill your security staff and bring threat hunting practices into your daily security practices? Learn more about how ReversingLabs can help your security teams today and watch an on-demand demo at reversinglabs.com/demo. For the stories behind the headlines, head to CISOseries.com.

December 23, 2020

Treasury Department's senior leaders were targeted by SolarWinds hack Draft lawsuit alleges Google and Facebook agreed to team up against antitrust action Three VPN providers with criminal ties taken down Thanks to our sponsor ReversingLabs Ransomware is responsible for causing the most destructive amount of downtime - more than seventeen hours. Are you equipped to fight ransomware? Do you have the latest intelligence and indicators of compromise to block these attacks? Learn more about how ReversingLabs can help your security teams today and watch an on-demand demo at reversinglabs.com/demo For the stories behind the headlines, head to CISOseries.com.

December 22, 2020

Attackers staged a dry-run against SolarWinds in October 2019 NSO Group spyware reportedly used against journalists CIA agents exposed with stolen data Thanks to our sponsor ReversingLabs Open source packages from repos such as PyPI, npm, RubyGems and NuGet can be complex, and contain tens of thousands of files. Are you confident these files are safe before you include them in your builds? What steps are you taking to reduce third-party risk? Learn more about how ReversingLabs can help your software and security teams today, and watch an on-demand demo at reversinglabs.com/demo For the stories behind the headlines, head to...

December 21, 2020

SolarWinds supply chain attack updates Trump officials plan to split up Cyber Command and NSA Google explains the cause of its recent outage Thanks to our sponsor ReversingLabs Seventy seven percent of organizations are increasing investments in automation to simplify and speed response times. How are you leveraging Machine Learning and AI to solve cyber skills shortages and mitigate risks to your business? Learn more about how ReversingLabs can automate threat analysis and accelerate security response today. Watch an on-demand demo at reversinglabs.com/demo. For the stories behind the headlines, head to CISOseries.com.

December 18, 2020

Ex-Homeland Security adviser: 'We're being hacked' Ignore Facebook 'Christmas bonus' come-on Twitter to start removing COVID-19 vaccine misinformation Thanks to our sponsor ReversingLabs A ransomware attack occurs every 10 seconds. What are you doing to detect hidden malware and expose key Indicators of compromise before they exploit your business. Learn more about how ReversingLabs can help your security teams today and watch an on-demand demo at reversinglabs.com/demo. For the stories behind the headlines, head to CISOseries.com.

December 17, 2020

Trump considers clemency for Silk Road founder Researcher warned of SolarWinds security issues last year What can the US do to prevent cyberattacks? Thanks to our sponsor ReversingLabs A ransomware attack occurs every 10 seconds. What are you doing to detect hidden malware and expose key Indicators of compromise before they exploit your business. Learn more about how ReversingLabs can help your security teams today and watch an on-demand demo at reversinglabs.com/demo. For the stories behind the headlines, head to CISOseries.com.

December 16, 2020

Microsoft seizes SolarWinds domain quarantine starts today Twitter will use Amazon Web Services to power user feeds Data breach at Canadian financial services firm highlights perils of insider threats Thanks to our sponsor ReversingLabs 96% of commercial applications include open source components. Is open source software putting your supply chain at risk? Learn more about how ReversingLabs can inspect your new software packages and open source components today, and watch an on-demand demo at reversinglabs.com/demo. For the stories behind the headlines, head to CISOseries.com.

December 15, 2020

SolarWinds Orion carrying malware Multiple US agencies impacted by SolarWinds supply-chain attack New EU data use legislation could lead to big tech fines Thanks to our sponsor ReversingLabs Cybersecurity staffing shortages exceed 3 million security professions globally, and the skills gap continues to widen. Learn how ReversingLabs automates the time-consuming task of analyzing malware, and how its explainable threat intelligence scales your security team to address complex cyberthreats. Watch an on-demand demo at reversinglabs.com/demo. For the stories behind the headlines, head to CISOseries.com.

December 14, 2020

Adrozek malware can infect over 30K Windows PCs a day Subway UK finds TrickBot on its menu Ransomware in schools grew in 2020, more on the way in 2021 Thanks to our sponsor ReversingLabsToday the most advanced threats lay hiddendeep within files and objects. In only milliseconds, ReversingLabs is able to analyze the world's most complex files, providing security executives with the risk insights they need to ensure business resiliency, while enabling a security staff of just a few to act as if they're a staff of hundreds, armed with an intelligence that eliminates your biggest risks. Learn more about...

December 11, 2020

Breaking up Facebook won't be easy Intel source 'Spider' outed in election lawsuit's redaction gaff AI is coming for your job slowly Thanks to our sponsor, Code42. Code42's annual Data Exposure Report on Insider Risk reveals that 42% of data breaches in the past year were caused by a malicious or criminal insider. Read the report for tips on how to stop your insider risk from becoming an insider threat. For the stories behind the headlines, go to CISOseries.com.

December 10, 2020

The Cybersecurity community responds to FireEye hack Christopher Krebs sues over threats of violence Google makes changes to how Chrome extensions handle data Thanks to our sponsor, Code42. Code42, insider risk detection and response leader, is excited to announce the release of its annual Data Exposure Report on Insider Risk. The report reveals that employees are nine times more likely to leak sensitive data than they were pre-COVID. The report will launch today at 1pm ET at this link. For the stories behind the headlines, go to CISOseries.com.

December 9, 2020

Microsoft's December 2020 Patch Tuesday fixes 58 vulnerabilities Unpatched bugs open GE radiological devices to remote code execution Cloudflare and Apple design a new privacy-friendly internet protocol Thanks to our sponsor, Code42. Tomorrow Code42 will release its annual Data Exposure Report on Insider Risk. Last year's report revealed that 63% of new hires who admit to taking data with them to a new job are repeat offenders. Tune in tomorrow for highlights from this year's report. For the stories behind the headlines, go to CISOseries.com.

December 8, 2020

Google publishes cross-site leaks wiki NSA warns of state-sponsored attacks on remote-work systems Greater Baltimore Medical Center hit with ransomware attack Thanks to our sponsor, Code42. Organizations are moving faster than ever before and security tools like DLP, UEBA and CASB can't keep up. Code42 Incydr takes a Zero Trust approach to managing and mitigating data risk from insider threats. Learn more about Code42 Incydr, the insider risk platform that offers insider risk detection and response. For the stories behind the headlines, go to CISOseries.com.

December 7, 2020

Drug dealers offer Pfizer vaccine on the Dark Web Data theft from Italian defense manufacturer was an inside job Philadelphia food bank loses $1 million in BEC scam Thanks to our sponsor, Code42. Code42 is a cybersecurity company that offers a completely new approach to the old problem of insider threats. Code42's insider risk platform, Incydr, helps organizations foster a culture of speed and collaboration while still preventing data loss without blocking. Learn more at Code42.com. For the stories behind the headlines, go to CISOseries.com.

December 4, 2020

Spotify celebrity pages defaced to plug Trump, Taylor Swift Clop ransomware gang rips off 2M credit cards from retailer E-Land 8% of all Google Play apps vulnerable to old security bug Thanks to our episode sponsor, AuthSafe. Are online frauds a concern for your organization? Is it a hurdle for progress? Timely predictions and detections with cognitive engines, should do the trick. SecureLayer7 presents Authsafe. A technology to prevent and detect Fraud attacks old and new. With the help of credential stuffing, manual strive as well as specialized automated tools, Authsafe prevents your organization's systems from being hampered. Learn more...

December 3, 2020

Malicious hackers target the Covid-19 vaccine 'cold chain' Hackers target US think tanks Massachusetts passes ban on police facial recognition Thanks to our episode sponsor, SecureLayer7. Managing the vulnerabilities and workflows within an organization can be a handful of a task. What your organization needs is a product that is capable of overseeing the workflows and security status for you. SecureLayer7 presents BugDazz. A pentest as a service cloud delivery platform, which makes it easier to keep tabs on the security of the systems. Read more:SecureLayer7.net For the stories behind the headlines, go to CISOseries.com.

December 2, 2020

US Supreme Court eyes narrowing of CFAA FBI warns of BEC scammers using email auto-forwarding in attacks Trump lawyer calls for Christopher Krebs' execution Thanks to our episode sponsor, SecureLayer7. Getting rid of vulnerabilities within the systems can be quite an intricate task. But why bother with anything else when there is an all in one cybersecurity package for organizations. A platform where existing, and prospective vulnerability threats can be identified and mitigated through their pentests within set time slots. SecureLayer7, the cybersecurity solution for your organization. Discover SecureLayer7.net For the stories behind the headlines, go to CISOseries.com.

December 1, 2020

Baltimore schools struggling with ransomware UK tightens restrictions on Huawei 5G equipment ZeroLogon now detected by Windows Defender Thanks to our episode sponsor, SecureLayer7. Getting rid of vulnerabilities within the systems can be quite an intricate task. But why bother with anything else when there is an all in one cybersecurity package for organizations. A platform where existing, and prospective vulnerability threats can be identified and mitigated through their pentests within set time slots. SecureLayer7, the cybersecurity solution for your organization. Discover SecureLayer7.net For the stories behind the headlines, head to CISOseries.com.

November 30, 2020

Biden transition team forced to build its own cybersecurity protections China owns the lion's share of internet cross-border data flow U.S. Supreme Court to rule on hacking laws Thanks to our episode sponsor, SecureLayer7. Getting rid of vulnerabilities within the systems can be quite an intricate task. But why bother with anything else when there is an all in one cybersecurity package for organizations. A platform where existing, and prospective vulnerability threats can be identified and mitigated through their pentests within set time slots. SecureLayer7, the cybersecurity solution for your organization. Discover SecureLayer7.net For the stories behind the headlines, head...

November 25, 2020

Brazil continues to recover from its worst cyberattack Apple's security chief indicted on bribery charges Baidu apps are leaking data Thanks to our sponsor, Dtex Traditional Employee Monitoring solutions are creepy. Capturing screenshots, recording keystrokes, monitoring web browsing and following social media activities is unnecessary and damages culture. DTEX InTERCEPT is the first and only solution that delivers the real-time workforce monitoring capabilities today's organizations need and employees will embrace. Learn more at dtexsystems.com. For more on any of the stories, head to cisoseries.com.

November 24, 2020

New Jersey passes anti-doxxing law TikTok patches account takeover flaw Watch out of DDoS on Black Friday Thanks to our sponsor, Dtex Forget projects, get answers. Start preventing insider threats, stopping data loss, and monitoring remote employees in minutes, not days. And do it all without invading user privacy. DTEX Systems helps enterprises run safer and smarter with a first-of-its-kind human-centric approach to enterprise operational intelligence. Learn more and start a free 30-day trial at dtexsystems.com. For more on any of the stories, head to cisoseries.com.

November 23, 2020

GoDaddy employees duped in cryptocurrency hack Global financial industry facing fresh round of cyberthreats Egregor ransomware prints its own ransom notes Thanks to our sponsor, Dtex Reliance on 'person of interest' identification and potential analyst bias have put first-generation insider threat solutions on the shelf. DTEX InTERCEPT offers IT and SecOps teams a new approach. Only DTEX InTERCEPT collects and analyzes user behavior, history, trends, and context answering the Who, What, When and How leading up to, and following, any potential Insider Threat event. Learn more at dtexsystems.com. For more on any of the stories, head to cisoseries.com.

November 20, 2020

Worldwide campaign targets ZeroLogon exploit Brandon Wales takes over at CISA Maybe ransomware operators aren't trustworthy after all? Thanks to our sponsor, Dtex Remote Workforce Security is a thing. Network detection and web proxy solutions have been rendered nearly useless as employees are working remotely and away from the corporate network. DTEX's Workforce Cyber Intelligence Platform not only allows employers with visibility to monitor user behavior for cybersecurity best practices, but also to protect the employee from external attack. Learn more at dtexsystems.com. For more on any of the stories, head to cisoseries.com.

November 19, 2020

Trump's tweets to lose protected status post-presidency macOS Big Sur lets apps slip past security safety nets Deepfake bot used to abuse women runs wild on Telegram Thanks to our sponsor, Dtex Endpoint DLP tools that rely on intrusive, resource intensive content inspection rules do nothing but slow down endpoint performance and upset your SecOps team. DTEX takes a behavioral approach to DLP. Only DTEX allows you to see the full lifecycle of user behavior activity and understand the who, what, when and how of a possible data loss incident. No false positives. Learn more at dtexsystems.com. For more on...

November 18, 2020

Trump fires CISA director Chris Krebs Facebook and Twitter grilled over US election actions Darktrace pays out nearly $2 million in overtime pay class action suit Thanks to our sponsor, Dtex Traditional Employee Monitoring solutions are creepy. Capturing screenshots, recording keystrokes, monitoring web browsing and following social media activities is unnecessary and damages culture. DTEX InTERCEPT is the first and only solution that delivers the real-time workforce monitoring capabilities today's organizations need and employees will embrace. Learn more at dtexsystems.com. For more on any of the stories, head to cisoseries.com.

November 17, 2020

Apple responds to macOS privacy concerns The ransomware landscape is increasingly crowded Microsoft pauses Windows 10 updates in December Thanks to our sponsor, Dtex Reliance on 'person of interest' identification and potential analyst bias have put first-generation insider threat solutions on the shelf. DTEX InTERCEPT offers IT and SecOps teams a new approach. Only DTEX InTERCEPT collects and analyzes user behavior, history, trends, and context answering the Who, What, When and How leading up to, and following, any potential Insider Threat event. Learn more at dtexsystems.com. For more on any of the stories, head to cisoseries.com.

November 16, 2020

Qualcomm receives U.S. permission to sell 4G chips to Huawei Microsoft says three APTs have targeted seven COVID-19 vaccine makers Cobalt Strike 4.0 toolkit shared online Thanks to our sponsor, Dtex Forget projects, get answers. Start preventing insider threats, stopping data loss, and monitoring remote employees in minutes, not days. And do it all without invading user privacy. DTEX Systems helps enterprises run safer and smarter with a first-of-its-kind human-centric approach to enterprise operational intelligence. Learn more and start a free 30-day trial at dtexsystems.com. For more on any of the stories, head to cisoseries.com.

November 13, 2020

Finland pushes through change to ID code law Researchers find Trickbot is still kicking New study looks at the source of Android malware And here's a special offer from our sponsor, Blumira. Staffing a 24/7 full-time security operations center with trained security analysts isn't a reality for many organizations. Blumira's end-to-end detection and response platform is designed to centralize log data, alert you to priority threats, then walk you through remediation with step-by-step security playbooks. Organizations and teams of any size, without security expertise, can leverage Blumira for automated detection and response. Deploy Blumira in hours with a free 14-day...

November 12, 2020

Facebook extends ban on political ads EU tightens cybersurveillance export laws Palo Alto Networks acquires Expanse And here's a special offer from our sponsor, Blumira. CISOs are all trying to do more with less these days; balancing compliance, security and business objectives. Consolidate your security with one end-to-end detection and response platform. Blumira works as a force multiplier, enabling your small teams to detect threats and respond to them quickly. Get a free 14-day trial of Blumira's cloud SIEM that you can deploy in hours, not weeks or months. That's Blumira.com. For more on any of today's stories, head to...

November 11, 2020

Biden aide Bill Russo attacks Facebook's post-election role Twitter could face its first GDPR penalty within days New Ghimob malware can spy on 153 Android mobile applications And here's a special offer from our sponsor, Blumira. Staffing a 24/7 full-time security operations center with trained security analysts isn't a reality for many organizations. Blumira's end-to-end detection and response platform is designed to centralize log data, alert you to priority threats, then walk you through remediation with step-by-step security playbooks. Organizations and teams of any size, without security expertise, can leverage Blumira for automated detection and response. Deploy Blumira in hours...

November 10, 2020

Inrupt launches enterprise privacy platform India's Bigbasket confirms cyberattack What's in a name? Turns out malware And here's a special offer from our sponsor, Blumira. The shift to cloud-based productivity and collaboration tools is a necessity and reality for many CISOs these days - but visibility into cloud threats can be challenging with limited staff and resources. Automating your security operations workflow is easier with Blumira's detection and response platform. Integrate Office 365 with Blumira to start realizing security value in a matter of hours with a free 14-day trial at Blumira.com. For more on any of today's stories, head...

November 9, 2020

Net neutrality and broadband expansion possible under Biden presidency Trump lawsuit site to report rejected votes leaked voter data Facebook releases disinformation probation policy And here's a special offer from our sponsor, Blumira. CISOs are all trying to do more with less these days; balancing compliance, security and business objectives. Consolidate your security with one end-to-end detection and response platform. Blumira works as a force multiplier, enabling your small teams to detect threats and respond to them quickly. Get a free 14-day trial of Blumira's cloud SIEM that you can deploy in hours, not weeks or months. That's Blumira.com. For...

November 6, 2020

Facebook updates its premature victory policy Michigan approves Proposal 2 Vermont National Guard called in to help with cyberattack Thanks to our sponsor, Trusona. Modern enterprise security starts at the desktop. By removing passwords from your desktop sign-in, you can instantly mitigate eight of the most common attack vectors, including SIM swapping, keylogging and credential stuffing. And with a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into their SSO for simple, secure access to all corporate applications, including Office 365. Bring your security up to date and learn more attrusona.com/desktopSSO. For more on any of the...

November 5, 2020

Facebook and Instagram add pop-up banners about election results Election night was seemingly free of cybersecurity drama California passes Prop 24 Thanks to our sponsor, Trusona. Secure your workforce with desktop MFA (passwords not included). Security leaders have been tasked with securing a remote workforce across a vulnerable variety of locations and Trusona is here to help. With a single passwordless desktop MFA sign-in, employees are automatically authenticated into their SSO for simple, secure access to all corporate applications, including Office 365. To learn more, visittrusona.com/desktopSSO. For more on any of our stories, head to CISOseries.com.

November 4, 2020

Instagram banner falsely advertises Wednesday as Election Day for some subscribers Robocalls urging voters to skip Election Day are subject of FBI investigation Ant Group falls afoul of Chinese regulators, causing Alibaba to drop 8 percent Thanks to our sponsor, Trusona. Trusonaenables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. For the...

November 3, 2020

Twitter clarifies its election results policy Google discloses Windows zero-day Maze ransomware operators call it quits Thanks to our sponsor, Trusona. Trusonaenables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. For more on all the stories, head toCISOseries.com.

November 2, 2020

Cybersecurity specialists list their election week fears Fact checking now extends back in time Hacker selling 34 million user records through broker Thanks to our sponsor, Trusona. Trusonaenables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. For more on all the stories, head to CISOseries.com.

October 30, 2020

Hackers steal funds from the Wisconsin Republican Party Ransomware attackers leak Georgia county voter information The FBI is investigating ransomware attacks on hospitals Thanks to our sponsor, F5. According to the 2020 State of Application Services report, 98% of organizations depend on applications to run or support their business. Innovative apps are essential for organizations that want to be first to market and first to profit. Learn more about securing your apps at the F5 Security Summit on November 10th. Register now. For more on this week's stories, head toCISOseries.com.

October 29, 2020

NSA refuses to say if it still uses encryption backdoors Ryuk ransomware smashes hospital networks across the U.S. Section 230 hearing devolves into political rants Thanks to our sponsor, F5. Learn about the cause of digital security breaches in your organization at the F5 Security Summit on November 10. At this premier industry event, you'll gain insights into breach root causes, and it may not be because of attacker innovation. Find out moreregister today to attend this free premier virtual security event. For more on this week's stories, head toCISOseries.com.

October 28, 2020

TikTok partners with Shopify on social commerce YouTube will add Election Day warning label: "Results may not be final" FBI: Hackers stole government source code via SonarQube instances Thanks to our sponsor, F5. A recent Forrester analysis of app security leader F5's SSL/TLS Visibility solution, which dynamically orchestrates traffic to your security stack, found the average customer will see an ROI of 373%. Register now for the F5 Security Summit, a leader in the app security space, to find out more about how to maximize your investments in security inspection technologies. Attendance is complimentary, Register today. For more on this...

October 27, 2020

Twitter to "pre-bunk" voter misinformation Microsoft to force load some webpages in Edge Google removed three apps for violating data collection policies Thanks to our sponsor, F5. Join experts across F5, a leader in the app security space, on November 10th, to gain valuable, innovative insights into enabling advanced application security, sophisticated cyber-attacks, trends in online fraud and how to manage risks in the cloud. Sign up now to join this must-attend virtual security event For more on this week's stories, head toCISOseries.com.

October 26, 2020

New Emotet attacks urges recipients to upgrade Microsoft Word Windows 10 now hides the SYSTEM control panel Samsung Group titan Lee Kun-hee dies aged 78 Thanks to our sponsor, F5. 58% of organizations say maintaining security and compliance when managing apps in a multi-cloud environment is their biggest challenge. Be sure to attend the premier virtual security summit on November 10th where F5, an expert in app security, will cover how to protect your applications from today's advanced attacks and tomorrow's emerging threats. Register now. For more on this week's stories, head to CISOseries.com.

October 23, 2020

Firefox testing 'Site Isolation' feature Cisco patches DoS bugs in network security products Proposed German legislation authorizes access to encrypted messages Thanks to our episode sponsor, AuthSafe. Are online frauds a concern for your organization? Is it a hurdle for progress? Timely predictions and detections with cognitive engines, should do the trick. SecureLayer7 presents Authsafe. A technology to prevent and detect Fraud attacks old and new. With the help of credential stuffing, manual strive as well as specialized automated tools, Authsafe prevents your organization's systems from being hampered. Learn more at Authsafe.ai For the stories behind the headlines, go to...

October 22, 2020

DOJ official accuses China of protecting cybercriminals Once again, Oracle releases enormous security update NSA warns of top vulnerabilities exploited by China Thanks to our episode sponsor, SecureLayer7. Managing the vulnerabilities and workflows within an organization can be a handful of a task. What your organization needs is a product that is capable of overseeing the workflows and security status for you. SecureLayer7 presents BugDazz. A pentest as a service cloud delivery platform, which makes it easier to keep tabs on the security of the systems. Read more:SecureLayer7.net For the stories behind the headlines, go to CISOseries.com.

October 21, 2020

Justice Department charges Google in antitrust lawsuit Microsoft partners with SpaceX to launch Azure Space initiative Twitter is temporarily changing how you retweet Thanks to our episode sponsor, SecureLayer7. Getting rid of vulnerabilities within the systems can be quite an intricate task. But why bother with anything else when there is an all in one cybersecurity package for organizations. A platform where existing, and prospective vulnerability threats can be identified and mitigated through their pentests within set time slots. SecureLayer7, the cybersecurity solution for your organization. Discover SecureLayer7.net For the stories behind the headlines, go to CISOseries.com.

October 20, 2020

US files charges against high profile attackers A new browser wants to look at social media algorithms Microsoft Exchange and OWA are increasingly malware targets Thanks to our episode sponsor, SecureLayer7. Getting rid of vulnerabilities within the systems can be quite an intricate task. But why bother with anything else when there is an all in one cybersecurity package for organizations. A platform where existing, and prospective vulnerability threats can be identified and mitigated through their pentests within set time slots. SecureLayer7, the cybersecurity solution for your organization. Discover SecureLayer7.net For the stories behind the headlines, head to CISOseries.com.

October 19, 2020

Google offers details on Chinese hacking group that targeted Biden campaign Hackers use BaseCamp to host and distribute malware China quietly opens up to the real internet - temporarily Thanks to our episode sponsor, SecureLayer7. Getting rid of vulnerabilities within the systems can be quite an intricate task. But why bother with anything else when there is an all in one cybersecurity package for organizations. A platform where existing, and prospective vulnerability threats can be identified and mitigated through their pentests within set time slots. SecureLayer7, the cybersecurity solution for your organization. Discover SecureLayer7.net For the stories behind the headlines,...

October 16, 2020

US DOJ unseals charges against malware money laundering ring Microsoft launches the Zero Trust Deployment Center Hack disrupts Barnes & Noble brick and mortar Thanks to this week's sponsor, Trusona. Trusonaenables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. For more, head toCISOSeries.com

October 15, 2020

Twitter hack sparks a call for monitoring social media platforms Zoom prepares to roll out end-to-end encryption Businesses are decreasing average malware dwell time Thanks to this week's sponsor, Trusona. Trusonaenables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. For more, head toCISOSeries.com

October 14, 2020

Security experts warn of Amazon Prime Day scams Office 365 remains a favorite for cyberattack persistence Homomorphic encryption finally finds the spotlight Thanks to this week's sponsor, Trusona. Trusonaenables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. For more, head to CISOSeries.com

October 13, 2020

Five Eyes alliance call for encryption backdoors (again) Trickbot isn't quite done yet Chinese facial recognition data leaks are rampant Thanks to this week's sponsor, Trusona. Trusonaenables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. More available atCISOseries.com.

October 12, 2020

Google is giving data to police based on search keywords, court docs show Tyler Technologies pays ransomware gang for decryption key U.K. businesses suffered a cyberattack every 45 sec. during Spring lockdown Thanks to this week's sponsor, Trusona. Trusona enables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. More available at CISOseries.com.

October 9, 2020

UK issues a report on Huawei 5G rollback Facebook will stop running political ads after the US election US seizes domains tied to Iranian misinformation campaign Thanks to our sponsor, Detectify. Detectifyis where security engineers and developers come to collaborate and build safer web apps using ethical hacker knowledge. Using payload-based testing, Detectify checks for 2000+ known vulnerabilities and helps you stay on top of emerging threats.Start a free 2-week trial today! For more, head to CISOseries.com.

October 8, 2020

Singapore introduces cybersecurity rating for 'smart' devices Watch out for Emotet, warns DHS Big takedowns don't stop Dark Web markets, says Europol Thanks to our sponsor, Detectify. Detectify is where security engineers and developers come to collaborate and build safer web apps using ethical hacker knowledge. Using payload-based testing, Detectify checks for 2000+ known vulnerabilities and helps you stay on top of emerging threats. Start a free 2-week trial today! For more, head to CISOseries.com.

October 7, 2020

Paying ransomware ransom is now illegal, according to the Treasury Department Cisco ordered to pay $1.9 billion for security patent infringement Covid tracking in Microsoft Excel loses 16,000 test results in England Thanks to our sponsor, Detectify. Detectify is where security engineers and developers come to collaborate and build safer web apps using ethical hacker knowledge. Using payload-based testing, Detectify checks for 2000+ known vulnerabilities and helps you stay on top of emerging threats. Start a free 2-week trial today! More available at CISOseries.com.

October 6, 2020

Ransomware disrupts COVID-19 vaccine trials SEC sues John McAfee over cryptocurrency promotion Firmware bootkit spotted in the wild Thanks to our sponsor, Detectify. Detectify is where security engineers and developers come to collaborate and build safer web apps using ethical hacker knowledge. Using payload-based testing, Detectify checks for 2000+ known vulnerabilities and helps you stay on top of emerging threats. Start a free 2-week trial today! For more, head to CISOseries.com.

October 5, 2020

Covid tracking apps from a Google-Apple partnership gaining traction in the U.S. FBI works more closely with spy agencies to hunt foreign hackers Phishing-with-worms campaign is declared a game-changer in password theft, account takeovers Thanks to our sponsor, Detectify. Detectify is where security engineers and developers come to collaborate and build safer web apps using ethical hacker knowledge. Using payload-based testing, Detectify checks for 2000+ known vulnerabilities and helps you stay on top of emerging threats. Start a free 2-week trial today! More available at CISOseries.com.

October 2, 2020

Huawei failed to address network security flaws US Treasury Department warns about fines for ransomware payments H&M fined for GDPR violations Thanks to our sponsor ReversingLabs ReversingLabs is the leading provider of explainable threat intelligence. In only milliseconds, ReversingLabs elastic threat infrastructure automatically analyzes the world's most complex files and detects the most advanced threats. ReversingLabs gives modern security and threat hunting teams the transparent insights and trusted input required to take fast and confident defensive action--all with zero interruption to business critical systems. Learn more by watching an on-demand demo atreversinglabs.com/demo For more, head toCISOSeries.com

October 1, 2020

Facebook faces down QAnon, bogus election ads, and privacy on the Gram Who took down 911 in 14 states on Monday? Controversial data company Palantir's stock is up following Wall Street debut Thanks to our sponsor ReversingLabs ReversingLabs is the leading provider of explainable threat intelligence. In only milliseconds, ReversingLabs elastic threat infrastructure automatically analyzes the world's most complex files and detects the most advanced threats. ReversingLabs gives modern security and threat hunting teams the transparent insights and trusted input required to take fast and confident defensive action--all with zero interruption to business critical systems. Learn more by watching an...

September 30, 2020

French shipping giant hit with ransomware attack Ransomware operators release personal information on Las Vegas students Android 12 will play nice with third-party apps stores Thanks to our sponsor ReversingLabs ReversingLabs is the leading provider of explainable threat intelligence. In only milliseconds, ReversingLabs elastic threat infrastructure automatically analyzes the world's most complex files and detects the most advanced threats. ReversingLabs gives modern security and threat hunting teams the transparent insights and trusted input required to take fast and confident defensive action--all with zero interruption to business critical systems. Learn more by watching an on-demand demo atreversinglabs.com/demo For more, head toCISOSeries.com

September 29, 2020

TikTok's latest court win means videos still available - for now Universal Health Services hospitals hit country-wide by Ryuk ransomware Windows XP and Windows Server 2003 source code leaked online Thanks to our sponsor ReversingLabs ReversingLabs is the leading provider of explainable threat intelligence. In only milliseconds, ReversingLabs elastic threat infrastructure automatically analyzes the world's most complex files and detects the most advanced threats. ReversingLabs gives modern security and threat hunting teams the transparent insights and trusted input required to take fast and confident defensive action--all with zero interruption to business critical systems. Learn more by watching an on-demand demo...

September 28, 2020

China's biggest chip maker hit by US sanctions Elon Musk unhappy over Microsoft's exclusive licensing of OpenAI Google removes 17 Android apps doing WAP billing fraud from the Play Store Thanks to our sponsor ReversingLabs ReversingLabs is the leading provider of explainable threat intelligence. In only milliseconds, ReversingLabs elastic threat infrastructure automatically analyzes the world's most complex files and detects the most advanced threats. ReversingLabs gives modern security and threat hunting teams the transparent insights and trusted input required to take fast and confident defensive action--all with zero interruption to business critical systems. Learn more by watching an on-demand demo...

September 25, 2020

DHS acknowledges leak of facial recognition images Judge rules the TikTok ban be delayed or defended Local government email systems are vulnerable to cyberattacks HUGE thanks to our sponsor, Trusona Trusonaenables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. For more, go to CISOseries.com.

September 24, 2020

Public-sector mega-vendor Tyler admits it was hacked ByteDance asks courts to block Trump order against TikTok Shopify says insiders to blame for stealing customer data HUGE thanks to our sponsor, Trusona Trusonaenables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. For more, go to CISOseries.com.

September 23, 2020

Maze ransomware adopts Ragnar Locker virtual machine approach Email addresses and passwords allegedly from NIH, WHO, and Gates Foundation dumped online Russian hackers use fake NATO training documents to breach government networks HUGE thanks to our sponsor, Trusona Trusonaenables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. For more, go to CISOseries.com.

September 22, 2020

CISA issues emergency directive to roll out a Windows Server patch 93% of organizations suffer data breaches through outbound email Facebook threatens withdrawal from EU HUGE thanks to our sponsor, Trusona Trusonaenables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. For more, go to CISOseries.com.

September 21, 2020

Trump approves Oracle's TikTok deal and delays app store ban ByteDance says it's not aware of $5 billion education fund in TikTok deal California judge halts Trump's WeChat ban HUGE thanks to our sponsor, Trusona Trusona enables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona's passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don't have to work around. For more, go to CISOseries.com.

September 18, 2020

Oracle's bid calls for access to TikTok's source code Patient dies in the wake of a ransomware attack Backdoors and bugs discovered in HiSilicon video encoders Thanks to our sponsor, Dtex Systems Forget projects, get answers. Start preventing insider threats, stopping data loss, and monitoring remote employees in minutes, not days. And do it all without invading user privacy. DTEX Systems helps enterprises run safer and smarter with a first-of-its-kind human-centric approach to enterprise operational intelligence. Learn more and start a free 30-day trial atdtexsystems.com. For more on CISO Series, go to cisoseries.com.

September 17, 2020

DOJ charges five Chinese citizens with global hacking campaign Two Russians phished $17 million in cryptocurrency, DOJ says Bluetooth flaw BLESA leaves billions of devices open to hackers Thanks to our sponsor, Dtex Systems Forget projects, get answers. Start preventing insider threats, stopping data loss, and monitoring remote employees in minutes, not days. And do it all without invading user privacy. DTEX Systems helps enterprises run safer and smarter with a first-of-its-kind human-centric approach to enterprise operational intelligence. Learn more and start a free 30-day trial atdtexsystems.com. For more on CISO Series, go to cisoseries.com.

September 16, 2020

Senator calls for US to reject Oracle's TikTok deal MFA bypass bugs opened Microsoft 365 to attack Ex-Facebook employee reveals extent of bot manipulation intended for political gain Thanks to our sponsor, Dtex Systems Forget projects, get answers. Start preventing insider threats, stopping data loss, and monitoring remote employees in minutes, not days. And do it all without invading user privacy. DTEX Systems helps enterprises run safer and smarter with a first-of-its-kind human-centric approach to enterprise operational intelligence. Learn more and start a free 30-day trial at dtexsystems.com. For more on CISO Series, go to cisoseries.com.

September 15, 2020

ByteDance chooses Oracle's bid to become TikTok's trusted technology partner Thousands of Magento stores compromised in a skimming campaign CISA warns Chinese state hackers are targeting enterprise infrastructure Thanks to our sponsor, Dtex Systems Forget projects, get answers. Start preventing insider threats, stopping data loss, and monitoring remote employees in minutes, not days. And do it all without invading user privacy. DTEX Systems helps enterprises run safer and smarter with a first-of-its-kind human-centric approach to enterprise operational intelligence. Learn more and start a free 30-day trial at dtexsystems.com. For more on CISO Series, go to cisoseries.com.

September 14, 2020

SoftBank close to a deal to sell Arm to Nvidia, creating a powerhouse Zoom now offers two-factor authentication China may kill TikTok's US operations rather than see them sold Thanks to our sponsor, Dtex Systems Forget projects, get answers. Start preventing insider threats, stopping data loss, and monitoring remote employees in minutes, not days. And do it all without invading user privacy. DTEX Systems helps enterprises run safer and smarter with a first-of-its-kind human-centric approach to enterprise operational intelligence.Learn more and start a free trial 30-day at dtexsystems.com. For more on CISO Series, go to cisoseries.com.

September 11, 2020

Portland passes bans on facial recognition technology. Bluetooth SIG publishes details on Blurtooth vulnerability. Microsoft detects attempted cyberattacks against US presidential campaigns. Thanks to our sponsor, Remediant Remediantis a fast growing Gartner Cool vendor focused on the concept of precision Privileged Access Management and one Fortune 100 company calls them "the world's best protection against major incidents." Remediant uniquely deploys & inventories thousands of privileged accounts in hours, locks down lateral movement & ransomware spread by removing standing privilege with a single action, and administers privileges just-in-time with MFA.

September 10, 2020

NSA, CIA have proof of Russians hacking Florida voting systems, says Woodward's 'Rage' DHS whistleblower alleges he was ordered to halt Russia analysis because Trump looked 'bad' U.S. Supreme Court will decide legality of bug bounties Thanks to our sponsor, Remediant Remediantis a fast growing Gartner Cool vendor focused on the concept of precision Privileged Access Management and one Fortune 100 company calls them "the world's best protection against major incidents." Remediant uniquely deploys & inventories thousands of privileged accounts in hours, locks down lateral movement & ransomware spread by removing standing privilege with a single action, and administers privileges...

September 9, 2020

China launches initiative to set global data-security rules Google releases new development platform that includes no-code tools and serverless computing Intel's supercomputer faces further delay Thanks to our sponsor, Remediant Remediant is a fast growing Gartner Cool vendor focused on the concept of precision Privileged Access Management and one Fortune 100 company calls them "the world's best protection against major incidents." Remediant uniquely deploys & inventories thousands of privileged accounts in hours, locks down lateral movement & ransomware spread by removing standing privilege with a single action, and administers privileges just-in-time with MFA. For more, head to CISOSeries.com

September 8, 2020

Visa discovers new skimming malware. The US issues a space policy directive on cybersecurity. Netwalker ransomware hits Argentina's immigration systems. Thanks to our sponsor, Remediant Remediant is a fast growing Gartner Cool vendor focused on the concept of precision Privileged Access Management and one Fortune 100 company calls them "the world's best protection against major incidents." Remediant uniquely deploys & inventories thousands of privileged accounts in hours, locks down lateral movement & ransomware spread by removing standing privilege with a single action, and administers privileges just-in-time with MFA.

September 4, 2020

Facebook formally codifies policy on third-party vulnerabilities. Apple delays changes to device ID collection. Geofence warrants strike out in federal court. Thanks to our sponsor, Trusona. Trusonaenables enterprises to provide enhanced security and usability to the workforce by removing passwords from the Windows 10 login experience. The solution works with your existing infrastructure without requiring any software or hardware upgrades like Windows Hello, cameras, biometric readers or on-premises servers making it the most cost-effective and user-friendly to deploy. For more, head to CISOSeries.com

September 3, 2020

U.S. spying exposed by Snowden was illegal, court rules DHS starts countdown clock on vulnerability disclosure policies Canadian police more reliant than ever on predictive computing Thanks to our sponsor, Trusona. Trusonaenables enterprises to provide enhanced security and usability to the workforce by removing passwords from the Windows 10 login experience. The solution works with your existing infrastructure without requiring any software or hardware upgrades like Windows Hello, cameras, biometric readers or on-premises servers making it the most cost-effective and user-friendly to deploy. For more, head to CISOSeries.com

September 2, 2020

Facebook threatens to block sharing of news stories in Australia Maximum lifespan of SSL/TLS certificates is now 398 days Elections offices across the U.S. using faulty electronic technology Thanks to our sponsor, Trusona. Trusonaenables enterprises to provide enhanced security and usability to the workforce by removing passwords from the Windows 10 login experience. The solution works with your existing infrastructure without requiring any software or hardware upgrades like Windows Hello, cameras, biometric readers or on-premises servers making it the most cost-effective and user-friendly to deploy. For more, head to CISOSeries.com

September 1, 2020

Apple accidentally notarized malware on macOS Security researchers detail a Netwalker play-by-play Mozilla find out "Why We Still Can't Browse in Peace" Thanks to our sponsor, Trusona. Trusonaenables enterprises to provide enhanced security and usability to the workforce by removing passwords from the Windows 10 login experience. The solution works with your existing infrastructure without requiring any software or hardware upgrades like Windows Hello, cameras, biometric readers or on-premises servers making it the most cost-effective and user-friendly to deploy. For more, head to CISOSeries.com

August 31, 2020

China's new salvo in TikTok war means restrictions on AI technology exports Slack fixes 'critical' vulnerability that left desktop app users open to attack Cisco engineer resigns then destroys WebEx accounts and virtual machines Thanks to our sponsor, Trusona. Trusonaenables enterprises to provide enhanced security and usability to the workforce by removing passwords from the Windows 10 login experience. The solution works with your existing infrastructure without requiring any software or hardware upgrades like Windows Hello, cameras, biometric readers or on-premises servers making it the most cost-effective and user-friendly to deploy. For more, head to CISOSeries.com

August 28, 2020

You can teach a Qbot new tricks Researchers expose unsecure printers The FBI releases details about ransomware scheme at Tesla Thanks to our sponsor Trend Micro For more, head to CISOSeries.com

August 27, 2020

Facebook warns Apple privacy changes will decimate ads Feds' stern warning for banks: Watch out for BeagleBoyz Feds put the kibosh on Russian's million-dollar malware scheme Thanks to our sponsor Trend Micro For more, head to CISOSeries.com

August 26, 2020

Epic judge will protect Unreal Engine but not Fortnite US military researchers may have found a more productive vulnerability discovery process Beijing's electronic dragnet closes on Hong Kong Thanks to our sponsor Trend Micro For more, head to CISOSeries.com

August 25, 2020

Application Guard for Office is now in public preview The WeChat executive order also faces a lawsuit It's like GitHub, but for China Thanks to our sponsor Trend Micro For more, head to CISOSeries.com

August 24th, 2020

TikTok plans to sue Trump administration over U.S. ban Former Uber security chief faces criminal charges for hiding 2016 breach Major wave of vishing attacks targets teleworkers Thanks to our sponsor Trend Micro For more, head to CISOSeries.com

August 21, 2020

Former Uber security chief charged with paying hush money to conceal breach Google fixes severe Gmail bug only after researcher goes public Pandemic work-from-home empowers voice phishers

August 20, 2020

Guardicore Labs discovers a previously unknown botnet CISA releases details on a new North Korean trojan Facebook enforces a ban on groups that discuss "potential violence"

August 19, 2020

Oracle enters race to buy TikTok's US operations Jack Daniel's hit with ransomware 200,000 Healthcare records exposed through GitHub credentials leak For more, head to CISOSeries.com

August 18, 2020

Trend Micro Finds Mac Malware in Xcode Projects Chrome To Warn Of Insecure Forms Security Breach Numbers Decrease, But Severity Increases in 2020 For more, head to CISOseries.com

August 17, 2020

President Trump creates 90-day deadline for ByteDance to divest from U.S. TikTok business Will the US be safer with a reduction in the reliance of Chinese manufacturing? A database designed to prevent harmful speech from going viral For more, head to CISOseries.com

Welcome to Cyber Security Headlines

This is just a welcome message to introduce subscribers to the Cyber Security Headlines podcast. A daily dose of information security news.