Cover image of Advanced Persistent Security
(7)
Technology
News
Tech News

Advanced Persistent Security

Updated 8 days ago

Technology
News
Tech News
Read more

This is a periodic audio podcast discussing current events and trends in Information and Cyber Security. Hallway con with a topic!

Read more

This is a periodic audio podcast discussing current events and trends in Information and Cyber Security. Hallway con with a topic!

iTunes Ratings

7 Ratings
Average Ratings
6
0
0
1
0

Great Podcast!

By Amish_G - Apr 20 2018
Read more
Fun and informative podcast that I can’t get enough of. Can’t wait to hear more.

Great new infosec podcast

By EDinATL - Apr 26 2016
Read more
Very informative and substantive discussions. The banter is kept to a minimum and the quality of the content is great for anyone with an interest in information security. There are a few sales pitches sprinkled around, but there is nothing annoying or excessive about their approach. I highly recommend checking out this podcast.

iTunes Ratings

7 Ratings
Average Ratings
6
0
0
1
0

Great Podcast!

By Amish_G - Apr 20 2018
Read more
Fun and informative podcast that I can’t get enough of. Can’t wait to hear more.

Great new infosec podcast

By EDinATL - Apr 26 2016
Read more
Very informative and substantive discussions. The banter is kept to a minimum and the quality of the content is great for anyone with an interest in information security. There are a few sales pitches sprinkled around, but there is nothing annoying or excessive about their approach. I highly recommend checking out this podcast.

Listen to:

Cover image of Advanced Persistent Security

Advanced Persistent Security

Updated 8 days ago

Read more

This is a periodic audio podcast discussing current events and trends in Information and Cyber Security. Hallway con with a topic!

Rank #1: Have I Been Pwned (with Troy Hunt)

Podcast cover
Read more

Have I Been Pwned (with Troy Hunt)

Advanced Persistent Security Podcast

Episode 19

Guest: Troy Hunt

September 19, 2016

If you enjoy this podcast, be sure to give us a 5 Star Review and “Love Us” on iTunes; Like us on Google Play, Stitcher, Sound Cloud, Spreaker, and YouTube.

NOTE: The opinions expressed in this podcast are ours alone and do not reflect those of our employers

Have I Been Pwned (with Troy Hunt) Show Notes

Part 1

I introduced Troy and he discussed his background. We discussed Intel selling McAfee. Troy does not see any major impacts on the landscape of anti-malware. Joe talks about the decline of anti-virus and the rise of Endpoint (Incident) Detection and Response (EDR/IDR) software. Troy mentions User Behavior Analytics (UBA) and the resurgence we are seeing and why. We then moved onto a discussion about President Obama appointing a CISO for the United States. Troy talks about the level of relevance this puts on Information and Cyber Security and how it ties into Critical Infrastructure.

In terms of Critical Infrastructure, we discussed the problems with the voter registration databases and not being considered “protected information.” We transition to further discuss the Filipino election commission and Australian census attacks. We discussed how/why people around the age of 16 are successful in conducting cyber attacks.

Part 2

We delve into how and why Troy created Have I Been Pwned. Troy was working to determine trends in data breaches. He reveals that he actually wrote most of it flying on a plane to the Philippines. He talks about flagging sensitive accounts and requiring verification before seeing if a user is on some breaches, like Ashley Madison or Brazzers. Troy reveals that he uses donations to keep Have I Been Pwned running. Troy talks about how he uses OSINT to discover information for Have I Been Pwned.

Part 3

Troy tells Joe about the Dropbox data leak. He reiterates that it is a “mega leak” and talks about the correlation between it and the Tumblr, Myspace, and LinkedIn leaks also from 2012. He discusses differences in the hashing algorithms used in the Dropbox leak and how hard some hashes were to break while others were incredibly simple. Troy reveals that someone tried to DDoS his site.

The conversation transitions to a discussion about password managers/vaults and Troy’s thoughts about the NIST Password recommendations. We vent about issues with passwords on websites and errors in planning on web sites such as length discrepancies and restricting characters.  We discuss the Brazzers leak and transition to talking about bug bounties.

Troy Hunt

About Troy

Troy Hunt is an Australian Microsoft Regional Director and also a Microsoft Most Valuable Professional for Developer Security. He does not work for Microsoft, but they’re kind enough to recognize his community contributions by way of their award programs which he has been an awardee of since 2011. Troy gets to interact with some fantastic people building their best products and then share what he knows about creating secure applications for the web with the broader community.

Pluralsight

Troy is a Pluralsight author of many top-rating courses on web security and other technologies. There’s no better way to get up to speed on a topic quickly than through professional training that you can take at your own pace. As both an author and a student, Troy has nothing but positive things to say about the breadth and quality of Pluralsight courses.

Pfizer

For fourteen years prior to going fully independent, Troy worked at Pfizer with the last seven years being responsible for application architecture in the Asia Pacific region. Time spent in a large corporate environment gave Troy huge exposure to all aspects of technology as well as the diverse cultures his role spanned. Many of the things Troy teaches in post-corporate life are based on these experiences, particularly as a result of working with a large number of outsourcing vendors across the globe. For more corporatey background, there’s always his LinkedIn profile.

 About Have I been pwned

One of the key projects Troy is  involved in today is Have I been pwned? (HIBP), a free service that aggregates data breaches and helps people establish if they’ve been impacted by malicious activity on the web. As well as being a useful service for the community, HIBP has given Troy an avenue to ship code that runs at scale on Microsoft’s Azure cloud platform, one of the best ways we have of standing up services on the web today.

Contacting Troy:

Twitter: @troyhunt
Website: http://troyhunt.com
Have I been pwned?

Troy’s Have I Been Pwned Donation page

Password Blog Links:

AlienVault
Hosted Locally on Advanced Persistent Security

Wi-Fi Blog Link:

AlienVault

Thanks for stopping by and checking out our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

If you have ANY Cybersecurity needs, please contact us and a member of our staff with promptly reply to your question or concern.

Enter your email address:
Delivered by FeedBurner

Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

Sep 19 2016

1hr 4mins

Play

Rank #2: Mobile Insecurity (with Georgia Weidman)

Podcast cover
Read more

Mobile Insecurity (with Georgia Weidman)

Advanced Persistent Security Podcast

Episode 11

Guest: Georgia Weidman

April 26, 2016

If you enjoy this podcast, be sure to give us a 5 Star Review and “Love Us” on iTunes; Like us on Google Play, Stitcher, Sound Cloud, Spreaker, and YouTube.

Mobile Insecurity Show Notes

Everyone wants to think about how secure they are. This podcast flips the script and assesses insecurity, specifically Mobile Insecurity. We discuss issues within the mobile computing ecosystem.

Part 1

Introductions and Current Event

Current Event: Apple Quick Time and why could it not have been Flash. Georgia’s dad still uses Microsoft XP and won’t connect his printer to the network.

Part 2

Georgia delivers her “Mobile Insecurity” talk and we discuss issues in the mobile threat landscape and possible mobile issues.

Mobile Malware, Ransomware, and MDM are discussed. Issues within the actual mobile Operating Systems are discussed briefly.

Joe asks if Georgia sees mobile devices distributing Ransomware and Malware to cars.

Part 3

Quick banter of Apple vs FBI and the implications of the precedent both attempted and actually set.

Part 4

Goodbyes and How to Contact Georgia

About Georgia:

Georgia Weidman Shevirah founder and CEO Georgia Weidman is a serial entrepreneur, penetration tester, security researcher, speaker, trainer, and author. She holds a MS in computer science as well as holding CISSP, CEH, and OSCP certifications. Her work in the field of smartphone exploitation has been featured internationally in print and on television. She has provided training at conferences such as Blackhat USA, Brucon, and CanSecWest. Georgia founded Bulb Security LLC, a security consulting firm specializing in security assessments/penetration testing, security training, and research/development. She was awarded a DARPA Cyber Fast Track grant to continue her work in mobile device security culminating in the release of the open source project the Smartphone Pentest Framework (SPF). She founded Shevirah Inc. to create product solutions for assessing and managing the risk of mobile devices in the enterprise and testing the effectiveness of enterprise mobility management solutions and is a graduate of the Mach37 cybersecurity accelerator. She is the author of Penetration Testing: A Hands-On Introduction to Hacking from No Starch Press. She was the recipient of the 2015 Women’s Society of CyberJutsu Pentest Ninja award. She is on the board of advisors of the angel backed security training startup Cybrary and the nonprofit Digital Citizens Alliance.
“There’s always going to be vulnerabilities” – Georgia Weidman

Contacting Georgia:

www.bulbsecurity.com www.shevirah.com (Coming Soon) Twitter: @georgiaweidman Penetration Testing:A Hands On Introduction Hacking is her book From the Publisher at https://www.nostarch.com/pentesting. If you buy it directly from No Starch Press you get a discount with the code GEORGIA.

APS Blog Posts

MedStar Health Cybersecurity Fails to Prevent Attack
Adobe Patches Exploited Vulnerability
Ransomware Locks MBR
Iranian hackers hit with Federal charges
Spear Phishermen Target Corporate W-2 Data
Google Fixes Kernel Vulnerability
4 Things to Know About Ransomware
Ransomware Hits Mac Computers
IRS Targeted in Another Cyberattack


Thanks for stopping by and checking out our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

If you have ANY Cybersecurity needs, please contact us and a member of our staff with promptly reply to your question or concern.

Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

Apr 26 2016

1hr 24mins

Play

Rank #3: Maintaining a SOC (with Rob Gresham)

Podcast cover
Read more

Maintaining a SOC (WITH Rob Gresham)

ADVANCED PERSISTENT SECURITY PODCAST

EPISODE 37

GUEST:Rob Gresham

February 20, 2017

If you enjoy this podcast, be sure to give us a 5 Star Review and “Love Us” on iTunes; Like us on Google Play, Stitcher, Sound Cloud, Spreaker, and YouTube.

NOTE: The opinions expressed in this podcast are ours alone and do not reflect those of our employers

Maintaining a SOC (WITH ROB GRESHAM)

SHOW NOTES

PART 1

Joe introduces Rob Gresham. Rob explains the Intel/McAfee/Foundstone dynamic. Rob tells us about the 6 degrees of Foundstone and the associated businesses and people. We recall and discuss SuperScan. We cover Threat Hunting in terms of what it is and it is not. Rob explains that Threat Hunting is learning YOUR ENVIRONMENT and determining when/where/how to meet the enemy.  Joe characterizes it as “Purple Teaming.” Rob provides an application of the Scientific Method using hypotheses to evaluate purple teaming.

Rob stresses to not be Elmer Fudd. Joe postulates IT F.U.D. (Fear, Uncertainty, Doubt, Elmer’s nephew).  Rob talks about attribution versus retribution. We talk about APTs and motivations of other types of attackers. Social Media as C2 (Command and Control) is discussed. We discuss the identification of Indicators that can be used in an actionable context. Joe gets on his training and awareness soapbox. The Cyber Kill Chain makes an appearance in regards to the applicability in network defense.

PART 2

In this special episode, the final in a two part series, we discuss how to create and maintain a successful SOC – Security Operations Center. Rob discusses the considerations in creating a maintaining a SOC in terms of goals and the environment around the SOC. He explains what a BOT is – a Build, Operate, Transfer model used by firms when helping organizations build their SOCs. Rob talks about decision making in terms of deciding to go with a Managed Security Service Provider (MSSP). Joe talks about contracts and SLAs as they relate to liability then transitions to realistic expectations. We close the segment in discussing sensor locations.

ABOUT ROB

Rob Gresham has extensive experience executing and instructing on cyber threat intelligence. Primarily on the information flow and analysis of operational, strategic and tactical cyber intelligence. He has extensive experience building data centers and enterprise environments with the proper security architecture and robust designs that enable business security needs and maturity over time with less rework. With  extensive experience, Rob investigates compromised systems, performs memory analysis and determines the scope of the breach. Rob has a perceptive talent for visualizing processes, workflows and procedures which has help tremendously when designing SOC process framework. He has successfully built security response teams that provide incident response for SOCs and critical infrastructure and key resource restoration teams.

CONTACTING ROB:

Twitter: @rwgresham
LinkedIn
Team Email: foundstone@intel.com
Webinar

JOE’S SECOND BLOG ON CISOCAST

CISOCast

JOE’S Social Engineering BLOG ON Black Hills Information Security

Black Hills Information Security

JOE’S AlienVault Blog about Insider Threat

AlienVault
Hosted Locally on Advanced Persistent Security

JOE’S Sword & Shield BLOG Post

Sword & Shield Blog
Hosted Locally on Advanced Persistent Security

JOE’S First BLOG ON CISOCast

CISOCast
Hosted Locally on Advanced Persistent Security

Joe’s Blog on Jenny Radcliffe’s Deception Chronicle

Jenny Radcliffe’s Deception Chronicles
Hosted Locally on Advanced Persistent Security

Joe’s Dyn DDOS Blog on Tripwire:

Tripwire
Hosted Locally on Advanced Persistent Security

Joe’s Ranking in the AlienVault Top Blogs of 2016:

AlienVault
Hosted Locally on Advanced Persistent Security

PASSWORD BLOG LINKS:

AlienVault
Hosted Locally on Advanced Persistent Security

WI-FI BLOG LINK:

AlienVault
Hosted Locally on Advanced Persistent Security

POWERSHELL LINK:

AlienVault

JOE’S BLOG ON ITSP:

When Friendly Thermostats & Toasters Join The IoT Dark Side

Joe’s Blog on Tripwire:

Burgling From an OSINT Point of View

Joe’s Blogs on Sword & Shield Enterprise Security’s site:

Holiday Shopping Safety Series: Shopping Via Credit Card and e-Commerce
Holiday Shopping Safety Series: Holiday Scams and Hoaxes

Joe’s Work with WATE 6 News in Knoxville, TN:

Shopping online safely this holiday season
iPhone scam uses text messages to hack iCloud information
Maryville hacker takes over Facebook accounts

Thanks for stopping by and checking out our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Enter your email address:
Delivered by FeedBurner

SUBSCRIBE TO OUR MAILING LIST

* indicates required Email Address *

First Name
Last Name

Feb 20 2017

1hr 25mins

Play

Rank #4: Threat Intelligence (with Rob Gresham)

Podcast cover
Read more

THREAT INTELLIGENCE (WITH Rob Gresham)

ADVANCED PERSISTENT SECURITY PODCAST

EPISODE 36

GUEST:Rob Gresham

February 13, 2017

If you enjoy this podcast, be sure to give us a 5 Star Review and “Love Us” on iTunes; Like us on Google Play, Stitcher, Sound Cloud, Spreaker, and YouTube.

NOTE: The opinions expressed in this podcast are ours alone and do not reflect those of our employers

Threat Intelligence (WITH Rob Gresham)

SHOW NOTES

PART 1

Joe introduces Rob Gresham. Rob explains the Intel/McAfee/Foundstone dynamic. Rob tells us about the 6 degrees of Foundstone and the associated businesses and people. We recall and discuss SuperScan. We cover Threat Hunting in terms of what it is and it is not. Rob explains that Threat Hunting is learning YOUR ENVIRONMENT and determining when/where/how to meet the enemy.  Joe characterizes it as “Purple Teaming.” Rob provides an application of the Scientific Method using hypotheses to evaluate purple teaming.

Rob stresses to not be Elmer Fudd. Joe postulates IT F.U.D. (Fear, Uncertainty, Doubt, Elmer’s nephew).  Rob talks about attribution versus retribution. We talk about APTs and motivations of other types of attackers. Social Media as C2 (Command and Control) is discussed. We discuss the identification of Indicators that can be used in an actionable context. Joe gets on his training and awareness soapbox. The Cyber Kill Chain makes an appearance in regards to the applicability in network defense.

PART 2

Rob tells us about MITRE and CVEs (Common Vulnerabilities and Exposures). He tells us about Adversarial Tactics Techniques And Common Knowledge  (ATTACK). Rob talks about actionable intelligence vice merely feeds or the tool de jour. Joe goes on his rant about the fallacy of silver bullet solutions. Rob talks about robust and elastic incident response planning. He tells us about adaptive and active containment.We talk about vendor diversity and the coverage in threat mitigation and identification. Rob talks about the level of influence and integration that machine learning has with antivirus companies like McAfee and Symantec. Rob brings the Pyramid of Pain into the discussion.

ABOUT Rob

Rob Gresham has extensive experience executing and instructing on cyber threat intelligence. Primarily on the information flow and analysis of operational, strategic and tactical cyber intelligence. He has extensive experience building data centers and enterprise environments with the proper security architecture and robust designs that enable business security needs and maturity over time with less rework. With  extensive experience, Rob investigates compromised systems, performs memory analysis and determines the scope of the breach. Rob has a perceptive talent for visualizing processes, workflows and procedures which has help tremendously when designing SOC process framework. He has successfully built security response teams that provide incident response for SOCs and critical infrastructure and key resource restoration teams.

CONTACTING Rob:

Twitter: @rwgresham
LinkedIn
Team Email: foundstone@intel.com
Webinar

JOE’S Second BLOG ON CISOCAST

CISOCast

JOE’S Social Engineering BLOG ON Black Hills Information Security

Black Hills Information Security

JOE’S AlienVault Blog about Insider Threat

AlienVault
Hosted Locally on Advanced Persistent Security

JOE’S Sword & Shield BLOG Post

Sword & Shield Blog
Hosted Locally on Advanced Persistent Security

JOE’S First BLOG ON CISOCast

CISOCast
Hosted Locally on Advanced Persistent Security

Joe’s Blog on Jenny Radcliffe’s Deception Chronicle

Jenny Radcliffe’s Deception Chronicles
Hosted Locally on Advanced Persistent Security

Joe’s Dyn DDOS Blog on Tripwire:

Tripwire
Hosted Locally on Advanced Persistent Security

Joe’s Ranking in the AlienVault Top Blogs of 2016:

AlienVault
Hosted Locally on Advanced Persistent Security

PASSWORD BLOG LINKS:

AlienVault
Hosted Locally on Advanced Persistent Security

WI-FI BLOG LINK:

AlienVault
Hosted Locally on Advanced Persistent Security

POWERSHELL LINK:

AlienVault

JOE’S BLOG ON ITSP:

When Friendly Thermostats & Toasters Join The IoT Dark Side

Joe’s Blog on Tripwire:

Burgling From an OSINT Point of View

Joe’s Blogs on Sword & Shield Enterprise Security’s site:

Holiday Shopping Safety Series: Shopping Via Credit Card and e-Commerce
Holiday Shopping Safety Series: Holiday Scams and Hoaxes

Joe’s Work with WATE 6 News in Knoxville, TN:

Shopping online safely this holiday season
iPhone scam uses text messages to hack iCloud information
Maryville hacker takes over Facebook accounts

Thanks for stopping by and checking out our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Enter your email address:
Delivered by FeedBurner

SUBSCRIBE TO OUR MAILING LIST

* indicates required Email Address *

First Name
Last Name

Feb 13 2017

1hr 44mins

Play

Rank #5: Red Teaming (with Joe Vest & James Tubberville)

Podcast cover
Read more

Red Teaming (with Joe Vest & James Tubberville)

ADVANCED PERSISTENT SECURITY PODCAST

EPISODE 34

GUEST:Joe Vest & James Tubberville

January 23, 2017

If you enjoy this podcast, be sure to give us a 5 Star Review and “Love Us” on iTunes; Like us on Google Play, Stitcher, Sound Cloud, Spreaker, Blubrry, and YouTube.

NOTE: The opinions expressed in this podcast are ours alone and do not reflect those of our employers

RED TEAMING (WITH JOE VEST & JAMES TUBBERVILLE)

SHOW NOTES

PART 1

Joe introduces Joe and James. Joe Vest tells us about his background in journey to Information Security and Penetration Testing. He explains that he and James were Red Teaming together then founded Minis with James. James echoes Joe’s sentiments and path. Mr. Vest tells us about how he had to break things as a system administrator to better understand how to secure them. He also tells us how to break into information security via system or network administration. Joe Gray tells us his advice to people trying to get into security. Mr. Vest talks about being passionate about technology which leads to a discussion about enthusiasm versus knowledge and experience.

We talk about the relationship between offense and defense; red and blue. We then transition into a discussion about FamilyTreeNow.com for the current event. It is discussed as an OSINT Playground. Mr. vest talks about “getting personal” when collecting data about targets. James talks about verifying relationships and build a smart password list and profile/dossier on targets. Joe Gray talks about his new FamilyTreeNow phishing proof of concept and the psychology behind making it work. We talk about the burden being on the user and best practices for creating awareness programs.

PART 2

We kick this segment with Mr. Vest discussing what types of penetration testing are used. Mr. Vest talks about the inverse triangle to the left that describes the focus in security assessment and testing. He talks about the realization of vulnerabilities in scope as the triangle narrows. Red Teaming is focused on specific scenarios and goals of which are called “Operational Impacts.” These are what makes organizations tick. Essentially, where can the organization be exploited to a point to cause catastrophic outcome for the organization. Think the worst case scenario for an organization.

This allows organizations to see what capabilities threat actors possess while measuring their security controls, defensive controls and procedures, and exercise their detection and response. Red Teaming is not specifically penetration testing on steroids. Red Teaming is more focused on meeting an objective to enable the organization to assess and measure their security posture and operations. Everything is goal driven. Mr. Vest talks about white carding and the assumed breach model. James talks about the correlation with penetration testing.

We discuss the maturity requirements for penetration testing and compare it to the maturity required for Red Teaming. Mr. Vest talks about providing value to an organization through engagement via red teaming psychology and goals. James clarifies that Blue Team is more than just traditional security defenders and includes Help Desk, System Admins, Networks, and BCP/DRP. Mr. Vest correlates Vulnerability Assessment and Penetration Testing to good security hygiene.

PART 3

James and Joe give us a war story about an engagement that dealt with an external access objective and an operational impact objective. The client CIO asked for a phishing campaign to demonstrate access. James and Joe noted that the client had sensitive files on a network that was not explicitly segregated as thought so. The impacts that dealt with detection and determining compromise and resiliency were implemented.

While ramping up presence (to attempt to be detected), the team quickly realized that they needed to make more noise to gain the attention of the blue team. They deployed EICAR, images, and audio bytes to get noticed. The blue team noticed this and made an announcement for all personnel to stop using network assets, causing a near 6 hour interruption. The blue team started pulling cables after they realized that a reboot did not work. The sound byte was selected from the Non-Rick Roll song below:

ABOUT Joe

Joe Vest has worked in the information technology industry for over 17 years with a focus on red teaming, penetration testing and application security. As a former technical lead for a DoD red team, he has extensive knowledge of cyber threats and their tools, tactics and techniques, including threat emulation and threat detection. Joe is the co-founder of MINIS LLC, providing innovative solutions for the mitigation against an ever-changing cyber threat. He is the technical editor for the book Red Team Field Manual (RTFM) and holds numerous security certifications. OSCP, CISSP-ISSMP, CISA, GPEN, GCIH, GWAPT, CEH

CONTACTING Joe:

Twitter: @JoeVest
LinkedIn
Email

ABOUT James

James’ Biography is coming soon.

CONTACTING James:

LinkedIn
Email

ABOUT Minis

Minis Website
Find Minis Github
Minis on LinkedIn
Find Minis on Twitter
Minis ThreatExchange Blog

joe and james’ SANS Course

Security 564: Red Team Operations and Threat Emulation

JOE’S Sword & Shield BLOG Post

Sword & Shield Blog
Hosted Locally on Advanced Persistent Security

JOE’S BLOG ON CISOCast

CISOCast

Joe’s Blog on Jenny Radcliffe’s Deception Chronicle

Jenny Radcliffe’s Deception Chronicles
Hosted Locally on Advanced Persistent Security

Joe’s Dyn DDOS Blog on Tripwire:

Tripwire
Hosted Locally on Advanced Persistent Security

Joe’s Ranking in the AlienVault Top Blogs of 2016:

AlienVault
Hosted Locally on Advanced Persistent Security

PASSWORD BLOG LINKS:

AlienVault
Hosted Locally on Advanced Persistent Security

WI-FI BLOG LINK:

AlienVault
Hosted Locally on Advanced Persistent Security

POWERSHELL LINK:

AlienVault

JOE’S BLOG ON ITSP:

When Friendly Thermostats & Toasters Join The IoT Dark Side

Joe’s Blog on Tripwire:

Burgling From an OSINT Point of View

Joe’s Blogs on Sword & Shield Enterprise Security’s site:

Holiday Shopping Safety Series: Shopping Via Credit Card and e-Commerce
Holiday Shopping Safety Series: Holiday Scams and Hoaxes

Joe’s Work with WATE 6 News in Knoxville, TN:

Shopping online safely this holiday season
iPhone scam uses text messages to hack iCloud information
Maryville hacker takes over Facebook accounts

Thanks for stopping by and checking out our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Enter your email address:
Delivered by FeedBurner

SUBSCRIBE TO OUR MAILING LIST

* indicates required Email Address *

First Name
Last Name

Jan 24 2017

1hr 31mins

Play

Rank #6: Ransomware and Incident Response (with Ben Johnson)

Podcast cover
Read more

Ransomware and Incident Response (WITH Ben Johnson)

ADVANCED PERSISTENT SECURITY PODCAST

EPISODE 33

GUEST:Ben Johnson

January 16, 2017

If you enjoy this podcast, be sure to give us a 5 Star Review and “Love Us” on iTunes; Like us on Google Play, Stitcher, Sound Cloud, Spreaker, and YouTube.

NOTE: The opinions expressed in this podcast are ours alone and do not reflect those of our employers

Ransomware and Incident Response (WITH Ben Johnson)

SHOW NOTES

PART 1

Joe introduces Ben and they briefly discuss Ben’s experiences and Carbon Black and how it came about. We will be discussing Incident Response a little later. Instead of talking about the news, we discuss Ransomware in 2016 and 2017. We talk about the Ransomware problem. Ben discusses the role of awareness in preventing Ransomware. We discuss the cultural impact of awareness and the do’s and dont’s of building an awareness program. Joe and Ben talk about non-punitive measures in programs and empowering employees. Ben tells us about fallacies like Full Disk Encryption being an absolute answer to Ransomware.

PART 2

Ben defines EDR (Endpoint Detection and Response) and the transition from “just anti-virus.” He  talks about detection and response vice reaction when doing Incident Response. We talk about critical and high risk positions and roles such as HR, Finance, Accounting, Contracting, and Editors and specific concerns for each. Ben gives us a devious idea about stealing metadata from PDFs from Job Announcements and other documents to use against organizations in OSINT and Social Engineering. We transition into a brief rant about Cloud Security and the lack of controls. Ben teaches us about black listing and white listing.

PART 3

Ben tells us about the difference between EDR and IDR (Incident Detection and Response). Joe asks Ben about his thoughts about Threat Hunting. We shift the discussion to successful implementations of Threat Hunting. Ben talks about subtle successes in Threat Hunting via identifying risk and threats that are not as obvious as things like attackers and APT. We talk about good hacker/information security mindsets that yield success. Ben arms us with advice to be successful in information security and “getting your hands dirty.”

ABOUT Ben

Ben Johnson

Ben Johnson is co-founder of Carbon Black and now an Executive in Residence for Ten Eleven Ventures as he flushes out his next company.  When at Carbon Black, Ben was CTO and Chief Security Strategist, where his duties including early development, building the technical team, setting the product vision, and then evangelizing and spreading the company message and offerings around the world to prospects, customers, and partners.  Prior to Carbon Black, Ben worked at NSA and then a defense contractor as an intrusion engineer.  Ben’s passionate about security, technology and entrepreneurship.  Ben has two computer science degrees (University of Chicago and Johns Hopkins University), and he currently teaches a masters level course in entrepreneurship at the University of Chicago.  Aside from all this, Ben enjoys being involved with other security startups as an advisor or board member.  Ben lives in Chicago.

CONTACTING Ben:

Twitter: @ChicagoBen

Joe’s Blog on Jenny Radcliffe’s Deception Chronicle

Jenny Radcliffe’s Deception Chronicles
Hosted Locally on Advanced Persistent Security

Joe’s Dyn DDOS Blog on Tripwire:

Tripwire
Hosted Locally on Advanced Persistent Security

Joe’s Ranking in the AlienVault Top Blogs of 2016:

AlienVault
Hosted Locally on Advanced Persistent Security

PASSWORD BLOG LINKS:

AlienVault
Hosted Locally on Advanced Persistent Security

WI-FI BLOG LINK:

AlienVault
Hosted Locally on Advanced Persistent Security

POWERSHELL LINK:

AlienVault

JOE’S BLOG ON ITSP:

When Friendly Thermostats & Toasters Join The IoT Dark Side

Joe’s Blog on Tripwire:

Burgling From an OSINT Point of View

Joe’s Blogs on Sword & Shield Enterprise Security’s site:

Holiday Shopping Safety Series: Shopping Via Credit Card and e-Commerce
Holiday Shopping Safety Series: Holiday Scams and Hoaxes

Joe’s Work with WATE 6 News in Knoxville, TN:

Shopping online safely this holiday season
iPhone scam uses text messages to hack iCloud information
Maryville hacker takes over Facebook accounts

Thanks for stopping by and checking out our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Enter your email address:
Delivered by FeedBurner

SUBSCRIBE TO OUR MAILING LIST

* indicates required Email Address *

First Name
Last Name

Jan 16 2017

1hr 32mins

Play

Rank #7: SANS Top 20 Critical Security Controls 1-4

Podcast cover
Read more

SANS Top 20 Critical Security Controls 1-4

The SANS SANS Top 20 Critical Security Controls are an industry and (for the most part) vendor neutral set of controls that organizations are encouraged to implement to ensure they are cognizant of security issues and can respond accordingly. This episode deals exclusively with the first 4 controls in-depth, so to not overwhelm listeners with what is shaping up to be a nearly 3 hour podcast.

If you want to discuss how Advanced Persistent Security can help you implement the SANS Top 20 Critical Security Controls, please contact Advanced Persistent Security Sales.

Content

This week, we begin to discuss the SANS Top 20 Critical Security Controls, this week we cover the following 4 Controls:
SANS Top 20 Critical Security Controls, #1: Inventory of Authorized and Unauthorized Devices
SANS Top 20 Critical Security Controls, #2: Inventory of Authorized and Unauthorized Software
SANS Top 20 Critical Security Controls, #3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
SANS Top 20 Critical Security Controls, #4: Continuous Vulnerability Assessment and Remediation
The Center for Internet Security Benchmarks Program
The NIST National Checklist Program

DISCLAIMER: Aside from receiving training from SANS and holding a certification from their partner organization, GIAC, neither Advanced Persistent Security nor myself, Joe Gray are affiliated with SANS. This podcast is authorized via SANS open use clause and is not officially authorized by SANS. There is no compensation to Advanced Persistent Security nor myself, Joe Gray for doing this podcast. The purpose is to increase awareness using open frameworks.

If you have any questions or concerns about the podcast or something you want featured on the podcast, please email us at podcast@advancedpersistentsecurity.net

Thanks for stopping by and listening to our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens to this – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Be sure to subscribe to this podcast and to our Blog.

References

NIST SP 800-53 Revision 4
SANS Top 20 Critical Security Controls




Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

Sep 24 2015

25mins

Play

Rank #8: This week in Security September 22 2015

Podcast cover
Read more

This week in Security: September 22, 2015

 Content

We discuss the 150 successful Department of Energy Cyber Attacks between 2010 and 2014, Excellus Blue Cross and Blue Shield data breach from December 2013 to August 2015, Android Lock Screen Buffer Overflow vulnerability discovered by the University of Texas, and rationalize a timeline for either changing Adobe Flash or discarding it based on the frequency and severity of it being exploited. We recap the blogs and I add a little information and perspective. This is a work in progress. The only way to improve at podcasting is to do it more. I will be applying my knowledge of security, coupled with my teaching experience to create valuable IT and Cyber Security podcasts as time progresses.

If you have any questions or concerns about the podcast or something you want featured on the podcast, please email us at podcast@advancedpersistentsecurity.net

Thanks for stopping by and listening to our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens to this – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Be sure to subscribe to this podcast and to our Blog.


Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

Sep 22 2015

15mins

Play

Rank #9: BSides Knoxville (with Roger Seagle)

Podcast cover
Read more

BSides Knoxville (with Roger Seagle)

Advanced Persistent Security Podcast

Episode 15

Guest: Roger Seagle

May 18, 2016

If you enjoy this podcast, be sure to give us a 5 Star Review and “Love Us” on iTunes; Like us on Google Play, Stitcher, Sound Cloud, Spreaker, and YouTube.

NOTE: The opinions expressed in this podcast are ours alone and do not reflect those of our employers.

BSides Knoxville Show Notes

BSides Knoxville co-organizer, Roger Seagle joins us to talk about security and his upcoming event BSides Knoxville. We discuss trends and happenings in security. our own backgrounds and opinions as well as what we are seeing in security.

Part 1

We kick it off with an introduction of Roger and his background. He has a PhD in Computer Science from University of Tennessee and has worked for Cisco for around 10 years. We kick it off with some post-DBIR discussion about ransomware, phishing, and password management utilities.

Part 2

 We talk about threat hunting and the internet of things. We talk about the evolution of security processes and the moving target. We talk about what  trends we anticipate next.

Part 3

We go over the history of BSides and over the talks at BSides Knoxville. Roger tells us about the tracks and the fact that there is something for everyone from beginner to expert. We discuss logistics, parking, and the ability to consume alcohol at the conference.

Contacting Roger:

Twitter: @rogwfu

BSides Knoxville Twitter: @BSidesKnoxville (Use hash tag #BSK2016)

BSides Knoxville Email: mailto:info@bsidesknoxville.com

Advanced Persistent Security has partnered with the EC-Council to provide a discounted EC-Council Training Event to our readers and listeners. The codes are only good for the Hacker Halted event in Atlanta, GA September 11-14 and 15-16, 2016. Below are the codes, if you have any questions, Contact Us:

SEPTEMBER 11TH-14TH, 2016

$1,999 Courses if you register using discount code: HHAPSTRN

Choose one of the following courses and exams:

  1. Certified Ethical Hacker (C|EH)*
  2. Computer Hacking Forensic Investigator (C|HFI)*
  3. Certified Security Analyst (E|CSA/L|PT)*
  4. Certified Chief Information Security Officer (C|CISO)*

All courses include:

  • Official Courseware
  • 1 Complimentary Exam Voucher
  • Certificate of attendance
  • Lunch and coffee breaks throughout the duration of the training
  • Complimentary Pass to Hacker Halted – Atlanta conference (September 15 & 16)

September 15-16, 2016

*Individual conference passes can be purchased for $35 (down from $199) Use code: HHAPSCON

Instructions for registration:

1) Click here

2) Fill in all the necessary info

3) Enter Qty (1) for conference pass – public

4) Enter promotional code HHAPSCON (for $35 Conference Passes) HHAPSTRN (for $1,999 Courses)

Recent APS Posts

Change Your Email Password Now!
Qatar Bank Breached After Bangladesh
Bangladesh Bank Loses 80 Million USD
Ransomware Infects Android 4.x
Spotify Allegedly Hacked…Again
MedStar Health Cybersecurity Fails to Prevent Attack
Ransomware Locks MBR
Iranian hackers hit with Federal charges
Spear Phishermen Target Corporate W-2 Data
4 Things to Know About Ransomware
Ransomware Hits Mac Computers

Thanks for stopping by and checking out our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

If you have ANY Cybersecurity needs, please contact us and a member of our staff with promptly reply to your question or concern.

Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

May 18 2016

45mins

Play

Rank #10: Jam Session: Ransomware Threat In 2016

Podcast cover
Read more

Jam Session: Ransomware Threat In 2016

Advanced Persistent Security Podcast

Episode 12

Guest: Matthew Eliason

April 29, 2016

If you enjoy this podcast, be sure to give us a 5 Star Review and “Love Us” on iTunes; Like us on Google Play, Stitcher, Sound Cloud, Spreaker, and YouTube.

Ransomware Show Notes

We all know that Ransomware is a PITA (Pain in the ___). This podcast, we discuss modern examples, infection vectors, mitigations, and root causes. This podcast is meant to start the discussion with management to begin to prevent malware infections instead of scramble to decrypt files or pay the extortionists.

Part 1

Is Ransomware the threat of the future?  Are companies understanding or taking the Ransomware threat seriously?  Today we take a hard look at the recent failings of various organizations. 

4 Thing to Know About Ransomware

MedStar Health biggest health organization to get hit by Ransomware

Part 2

Is it better to pay the Ransom? Discussion and some differing opinions here.

FBI says “better to pay ransom in some cases”

Part 3

Ransomware uses Social Engineering to be the most effective

W-2 data stolen using Social Engineering

 APS Blog Posts

MedStar Health Cybersecurity Fails to Prevent Attack
Adobe Patches Exploited Vulnerability
Ransomware Locks MBR
Iranian hackers hit with Federal charges
Spear Phishermen Target Corporate W-2 Data
Google Fixes Kernel Vulnerability
4 Things to Know About Ransomware
Ransomware Hits Mac Computers
IRS Targeted in Another Cyberattack


Thanks for stopping by and checking out our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

If you have ANY Cybersecurity needs, please contact us and a member of our staff with promptly reply to your question or concern.

Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

Apr 29 2016

38mins

Play

Rank #11: Shoulders of Infosec (with Jack Daniel)

Podcast cover
Read more

Shoulders of Infosec (with Jack Daniel)

ADVANCED PERSISTENT SECURITY PODCAST

EPISODE 20

GUEST: Jack Daniel

SEPTEMBER 26, 2016

If you enjoy this podcast, be sure to give us a 5 Star Review and “Love Us” on iTunes; Like us on Google Play, Stitcher, Sound Cloud, Spreaker, and YouTube.

NOTE: The opinions expressed in this podcast are ours alone and do not reflect those of our employers

I apologize for my voice and coughing, I was fighting off some “crud.”

Shoulders of Infosec (with Jack Daniel) SHOW NOTES

PART 1

I introduced Jack and we discussed his Hacker Halted talk and Shoulders of Infosec. We talk about buzzword reuse and the challenges that infosec people face. Jack talks about how to react to and talk to the business unit as a security professional. Joe channels his inner Kenny Rogers in The Gambler, “You have to know when to hold ’em and know when to fold ’em.” We transition into a discussion about passwords and password managers. We also discuss prioritizing security from the perspective of budget, effort, and business.

PART 2

Jack tells us what is bothering him (he gets wound up easily). The inability to see the world views of others bothers Jack. Joe and Jack talk about security elitism and those who believe that people who don’t write code can’t be security people and the frustrations with that belief. Jack provides his advice to the up and coming infosec people. We talk about certifications vice experience vice studying to learn. Jack mentions phosgene gas and reminds Joe of his Navy days aboard a submarine. Jack affirms that pen testing is not the end all/be all of working in infosec. Take technical writing classes! 

PART 3

Jack says goodbye and provides more information about Shoulders of Infosec. He gives us links to his social media and other endeavors. Jack tells us about his “Infosec Survival Skills” talks coming up as well as other topics he is passionate about.

About Jack

Jack Daniel

Jack Daniel works for Tenable Network Security, has over 20 years’ experience in network and system administration and security, and has worked in a variety of practitioner and management positions.

A technology community activist, he supports several information security and technology organizations. Jack is a co-founder of Security BSides, serves on the boards of three Security BSides non-profit corporations, and helps organize Security B-Sides events.

Jack is a frequent speaker at technology and security events and is a co-host on the award-winning Security Weekly Podcast. An early member of the information security community on Twitter, Jack is an active and vocal Twitter user. Jack is a CISSP, holds CCSK, and is a Microsoft MVP for Enterprise Security.

ABOUT Shoulders of Infosec

One of the key projects Jack is involved in today is Shoulders of Infosec.

“If I have seen further it is by standing on the shoulders of giants”

Most famously attributed to Sir Isaac Newton, this quote reflects the sentiment of this project. All of us in the field of information security stand on the shoulders of giants, this project is dedicated to shining a light on those shoulders- the the known and unknown.

This blog will primarily be used for updates and announcements, most of the content will be on a wiki at wiki.shouldersofinfosec.org.

CONTACTING Jack:

Twitter: @jack_daniel
Twitter: @InfosecNoir
Website: Shoulders of Infosec
Security BSides
Security Weekly (Podcast)
Uncommon Sense Security Blog
Traveling Curmudgeon Blog (Jack’s Travels)

PASSWORD BLOG LINKS:

AlienVault
Hosted Locally on Advanced Persistent Security

WI-FI BLOG LINK:

AlienVault
Hosted Locally on Advanced Persistent Security

Powershell LINK:

AlienVault

The Zen of Python

To recreate this, type: python import this

Beautiful is better than ugly.
Explicit is better than implicit.
Simple is better than complex.
Complex is better than complicated.
Flat is better than nested.
Sparse is better than dense.
Readability counts.
Special cases aren’t special enough to break the rules.
Although practicality beats purity.
Errors should never pass silently.
Unless explicitly silenced.
In the face of ambiguity, refuse the temptation to guess.
There should be one– and preferably only one –obvious way to do it.
Although that way may not be obvious at first unless you’re Dutch.
Now is better than never.
Although never is often better than *right* now.
If the implementation is hard to explain, it’s a bad idea.
If the implementation is easy to explain, it may be a good idea.
Namespaces are one honking great idea — let’s do more of those!

Thanks for stopping by and checking out our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

If you have ANY Cybersecurity needs, please contact us and a member of our staff with promptly reply to your question or concern.

Enter your email address:
Delivered by FeedBurner

SUBSCRIBE TO OUR MAILING LIST

* indicates required Email Address *

First Name
Last Name

Sep 26 2016

51mins

Play

Rank #12: SANS Top 20 Critical Security Controls 5-8

Podcast cover
Read more

SANS Top 20 Critical Security Controls 5-8

The SANS SANS Top 20 Critical Security Controls are an industry and (for the most part) vendor neutral set of controls that organizations are encouraged to implement to ensure they are cognizant of security issues and can respond accordingly. This episode deals exclusively with the second 4 (Numbers 5-8) controls in-depth, so to not overwhelm listeners with what is shaping up to be a nearly 3 hour podcast.

If you want to discuss how Advanced Persistent Security can help you implement the SANS Top 20 Critical Security Controls, please contact Advanced Persistent Security Sales.

Content

This week, we begin to discuss the SANS Top 20 Critical Security Controls, this week we cover the following 4 Controls:
SANS Top 20 Critical Security Controls, #5: Malware Defenses
SANS Top 20 Critical Security Controls, #6: Application Software Security
SANS Top 20 Critical Security Controls, #7: Wireless Access Control
SANS Top 20 Critical Security Controls, #8: Data Recovery Capability

DISCLAIMER: Aside from receiving training from SANS and holding a certification from their partner organization, GIAC, neither Advanced Persistent Security nor myself, Joe Gray are affiliated with SANS. This podcast is authorized via SANS open use clause and is not officially authorized by SANS. There is no compensation to Advanced Persistent Security nor myself, Joe Gray for doing this podcast. The purpose is to increase awareness using open frameworks.

If you have any questions or concerns about the podcast or something you want featured on the podcast, please email us at podcast@advancedpersistentsecurity.net

Thanks for stopping by and listening to our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens to this – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Be sure to subscribe to this podcast and to our Blog.

References

NIST SP 800-53 Revision 4
SANS Top 20 Critical Security Controls




Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

Oct 01 2015

20mins

Play

Rank #13: This week in Security September 29 2015

Podcast cover
Read more

This week in Security: September 29, 2015

We discuss the recent attack on Apple’s App Store that revealed a fraudulent version of XCode (XCode Ghost) that inserted malware into over 300 apps. We also discuss the cyber landscape for Federal IT Security and  the strained Cyber relations between the U.S. and China. We recap the blogs and I add a little information and perspective.

This is a work in progress. The only way to improve at podcasting is to do it more. I will be applying my knowledge of security, coupled with my teaching experience to create valuable IT and Cyber Security podcasts as time progresses.

If you have any questions or concerns about the podcast or something you want featured on the podcast, please email us at podcast@advancedpersistentsecurity.net

Thanks for stopping by and listening to our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens to this – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Be sure to subscribe to this podcast and to our Blog.


Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

Sep 29 2015

13mins

Play

Rank #14: This week in Security September 14 2015

Podcast cover
Read more

This week in Security: September 14, 2015

Content

This week, we discuss the OPM cyber attack, baby monitors, & FireEye/Kaspersky issues & follow up to the Ashley Madison hack. We recap the blogs and I add a little information and perspective. This is a work in progress. The only way to improve at podcasting is to do it more. I will be applying my knowledge of security, coupled with my teaching experience to create valuable IT and Cyber Security podcasts as time progresses.

If you have any questions or concerns about the podcast or something you want featured on the podcast, please email us at podcast@advancedpersistentsecurity.net

Thanks for stopping by and listening to our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens to this – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Be sure to subscribe to this podcast and to our Blog.


Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

Sep 14 2015

20mins

Play

Rank #15: This week in Security: October 6, 2015

Podcast cover
Read more

This week in Security: October 6, 2015

Content

We discuss the recent attack on T-Mobile/Experian, Trump Hotel’s Malware Infection, Cyphinx Cyber Security Training Video Game, and the world of automobile cyber security. The automobile portion discusses attacks on Tesla, Chrysler, Fiat, Dodge, Ram, and On-Star. We look at how the Volkswagen emissions issue may change cyber security in the auto industry.

This is a work in progress. The only way to improve at podcasting is to do it more. I will be applying my knowledge of security, coupled with my teaching experience to create valuable IT and Cyber Security podcasts as time progresses.

If you have any questions or concerns about the podcast or something you want featured on the podcast, please email us at podcast@advancedpersistentsecurity.net

Thanks for stopping by and listening to our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens to this – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Be sure to subscribe to this podcast and to our Blog.


Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

Oct 06 2015

24mins

Play

Rank #16: This Week in Security: October 13, 2015

Podcast cover
Read more

This week in Security: October 13, 2015

Content

This week, we provide a follow up to the Experian/T-Mobile data breach and discuss the Scottrade data breach, Nuclear Facilities at risk, and Dow Jones data breach. We recap the blogs and I add a little information and perspective. This is a work in progress. The only way to improve at podcasting is to do it more. I will be applying my knowledge of security, coupled with my teaching experience to create valuable IT and Cyber Security podcasts as time progresses.

If you have any questions or concerns about the podcast or something you want featured on the podcast, please email us at podcast@advancedpersistentsecurity.net

Thanks for stopping by and listening to our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens to this – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Be sure to subscribe to this podcast and to our Blog.


Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

Oct 13 2015

18mins

Play

Rank #17: SANS Top 20 Critical Security Controls 13-16

Podcast cover
Read more

SANS Top 20 Critical Security Controls 13-16

The SANS SANS Top 20 Critical Security Controls are an industry and (for the most part) vendor neutral set of controls that organizations are encouraged to implement to ensure they are cognizant of security issues and can respond accordingly. This episode deals exclusively with the fourth 4 (Numbers 13-16) controls in-depth, so to not overwhelm listeners with what is shaping up to be a nearly 3 hour podcast.

If you want to discuss how Advanced Persistent Security can help you implement the SANS Top 20 Critical Security Controls, please contact Advanced Persistent Security Sales.

Content

This week, we begin to discuss the SANS Top 20 Critical Security Controls, this week we cover the following 4 Controls:
SANS Top 20 Critical Security Controls, #13: Boundary Defense
SANS Top 20 Critical Security Controls, #14: Maintenance, Monitoring, and Analysis of Audit Logs
SANS Top 20 Critical Security Controls, #15: Controlled Access Based on the Need to Know
SANS Top 20 Critical Security Controls, #16: Account Monitoring and Control

DISCLAIMER: Aside from receiving training from SANS and holding a certification from their partner organization, GIAC, neither Advanced Persistent Security nor myself, Joe Gray are affiliated with SANS. This podcast is authorized via SANS open use clause and is not officially authorized by SANS. There is no compensation to Advanced Persistent Security nor myself, Joe Gray for doing this podcast. The purpose is to increase awareness using open frameworks.

If you have any questions or concerns about the podcast or something you want featured on the podcast, please email us at podcast@advancedpersistentsecurity.net

Thanks for stopping by and listening to our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens to this – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Be sure to subscribe to this podcast and to our Blog.


References

NIST SP 800-53 Revision 4
SANS Top 20 Critical Security Controls




Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

Oct 15 2015

21mins

Play

Rank #18: SANS Top 20 Critical Security Controls 9-12

Podcast cover
Read more

SANS Top 20 Critical Security Controls 9-12

The SANS SANS Top 20 Critical Security Controls are an industry and (for the most part) vendor neutral set of controls that organizations are encouraged to implement to ensure they are cognizant of security issues and can respond accordingly. This episode deals exclusively with the third 4 (Numbers 9-12) controls in-depth, so to not overwhelm listeners with what is shaping up to be a nearly 3 hour podcast.

If you want to discuss how Advanced Persistent Security can help you implement the SANS Top 20 Critical Security Controls, please contact Advanced Persistent Security Sales.

Content

This week, we begin to discuss the SANS Top 20 Critical Security Controls, this week we cover the following 4 Controls:
SANS Top 20 Critical Security Controls, #9: Security Skills Assessment and Appropriate Training to Fill Gaps
SANS Top 20 Critical Security Controls, #10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
SANS Top 20 Critical Security Controls, #11: Limitation and Control of Network Ports, Protocols, and Services
SANS Top 20 Critical Security Controls, #12: Controlled Use of Administrative Privileges

DISCLAIMER: Aside from receiving training from SANS and holding a certification from their partner organization, GIAC, neither Advanced Persistent Security nor myself, Joe Gray are affiliated with SANS. This podcast is authorized via SANS open use clause and is not officially authorized by SANS. There is no compensation to Advanced Persistent Security nor myself, Joe Gray for doing this podcast. The purpose is to increase awareness using open frameworks.

If you have any questions or concerns about the podcast or something you want featured on the podcast, please email us at podcast@advancedpersistentsecurity.net

Thanks for stopping by and listening to our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens to this – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Be sure to subscribe to this podcast and to our Blog.


References

NIST SP 800-53 Revision 4
SANS Top 20 Critical Security Controls




Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

Oct 08 2015

21mins

Play

Rank #19: 2017 Holiday Podcaster’s Podcast (NSF Kids/Work)

Podcast cover
Read more

2017 Holiday Podcaster’s Podcast (NSF Kids/Work)

ADVANCED PERSISTENT SECURITY

December 22, 2017

If you enjoy this podcast, be sure to give us a 5 Star Review and “Love Us” on iTunes; Like us on Google Play, Stitcher, Sound Cloud, Spreaker, and YouTube.

NOTE: The opinions expressed in this show are ours alone and do not reflect those of our employers

2017 HOliday Podcaster’s Podcast (NSF Kids/Work) SHOW NOTES

SUPER NOT SAFE for kids (and probably adults, come to think of it). Really this is just us griping and remaining hopeful for industry.

Thanks for stopping by and checking out our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Enter your email address:
Delivered by FeedBurner

SUBSCRIBE TO OUR MAILING LIST

* indicates required Email Address *

First Name
Last Name

Dec 22 2017

1hr 22mins

Play

Rank #20: This week in Security: October 20, 2015

Podcast cover
Read more

This week in Security: October 20, 2015

This week, we discuss the Adobe Flash, Google Android Zero Day, and Cyberwar esclations. We recap the blogs and I add a little information and perspective. This is a work in progress. The only way to improve at podcasting is to do it more. I will be applying my knowledge of security, coupled with my teaching experience to create valuable IT and Cyber Security podcasts as time progresses.

Related Blogs:

Why The Future of Android Depends on Security
Cyberwar Begins New Arms Race
Latest Bug for Adobe Flash the Nail in the Coffin?

If you have any questions or concerns about the podcast or something you want featured on the podcast, please email us at podcast@advancedpersistentsecurity.net

Thanks for stopping by and listening to our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens to this – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Be sure to subscribe to this podcast and to our Blog.


Enter your email address:
Delivered by FeedBurner


Subscribe to our mailing list

* indicates required Email Address *

First Name
Last Name

//
//

Oct 20 2015

10mins

Play