Decipher Security Podcast

The Sony Pictures hack in 2014 by the North Korean Lazarus Group was a seminal event both in Hollywood and in the security community, bringing to light the capabilities and ambitions of North Korean attackers and showing the damage a leak of sensitive data can be. Brian Raftery joins Dennis Fisher to discuss his new Ringer podcast, The Hollywood Hack, that digs deep into the incident, its repercussions in Hollywood, and how it helped set the tone for how companies handle public data leaks.

The focus was on Iranian APTs this week, both from private threat intelligence teams and CISA, exposing new operations from UNC757 and other groups targeting government, higher education, and private industry. We also check in on a new report from Google's Threat Analysis Group on APTs using the same exploits for zero days that were developed by private commercial surveillance vendors NSO Group and Intellexa.

Reddit's head of application security Matt Johansen joins Dennis Fisher to talk about the highlights of Black Hat USA, the challenges of sorting security priorities in a large enterprise, and how he's learned to take care of his mental health after many years in the security industry. 

Rebekah Brown and John Scott-Railton of the Citizen Lab join Dennis Fisher to dive into their group's new report on highly targeted spear phishing campaigns by the Russian threat actor COLDRIVER and then discuss the emergence of a new, possibly related group called COLDWASTREL. 

Dennis Fisher and Lindsey O'Donnell-Welch reflect on their week in Las Vegas at Black Hat and discuss the talks they liked, including Moxie Marlinspike's keynote and the Google Project Zero retrospective, and the other topics they found interesting, including vulnerability exploitation versus social engineering and the AI ecosystem.

At Black Hat USA this year, Josh Harguess and Chris Ward, with Cranium AI, talk about the security challenges that organizations are experiencing while implementing AI in their environments, what AI red teaming consists of and the backstory of how MITRE Labs' AI Red Team came to be.

AI and machine learning security expert Gary McGraw joins Dennis Fisher to discuss the concept of data feudalism in LLM foundation models, what the security implications of it are, and whether narrowly focused models may help address these issues. 

Decipher editors Dennis Fisher and Lindsey O"Donnell-Welch are joined by Brian Donohue to dissect the Black Hat talks they're looking forward to, including sessions with H D Moore, Sherrod DeGrippo, and Moxie Marlinspike, and some talks they can't quite figure out from the titles.

The fallout from the CrowdStrike outage continues more than a week after the faulty update, so Huntress security researcher John Hammond joins Dennis Fisher to talk about the lessons learned from the incident, our fragile software ecosystem, and what cybersecurity practitioners can do differently next time.

Tyler Healy, CISO of Digital Ocean, joins Dennis Fisher to discuss the unique challenges of defending a huge platform, how AI is changing things for defenders, and what new challenges AI might bring in the near future. 

CrowdStrike said a problem with an update the company pushed to Falcon sensors on Windows hosts on July 18 caused a blue screen of death, an issue that coincided with a Microsoft Azure outage and widespread outages across airlines, banks, hospitals, and other services.Our story on this incident: https://duo.com/decipher/crowdstrike-windows-update-linked-to-global-outagesThe Windows monoculture paper: https://www.schneier.com/essays/archives/2003/09/cyberinsecurity_the.html

FIN7 is a highly active and capable cybercrime group also known as Carbanak that has been evolving and using its own tools such as AVNeutralizer for many years. SentinelOne researchers Antonio Cocomazzi helps us dig into the group's tactics and tools.Read Antonio's new research here: https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/

Former NSA Deputy Director George Barnes joins Dennis Fisher to talk about his 35-year career at the agency, how he came to be intrigued by the cybersecurity world, the emergence of Cyber Command as a force inside the government, and what he sees as the priorities for defenders now.

Chris Hughes, co-founder of Aquia and a Cyber Innovation Fellow at the Cybersecurity and Infrastructure Security Agency, joins Dennis Fisher to talk about the challenges of supply chain security, working with the government to address systemic issues, and the importance of collaboration. 

Dennis Fisher and Lindsey O'Donnell-Welch dig into the news of the TeamViewer corporate breach, attributed to APT29/Midnight Blizzard, and news of more victims from the Microsoft intrusion by the same group earlier this year.

Multi-factor authentication (MFA) is a critical form of defense for organizations, and threat actors are recognizing that: According to the latest Cisco Talos Incident Response Quarterly Trends report, instances related to MFA were involved in some capacity in half of all security incidents that the Talos team responded to in the first quarter of 2024.Hazel Burton with Cisco Talos talks about how threat actors are using targeted social engineering techniques to try to skirt by MFA, how phishing kits are increasingly incorporating MFA bypass tactics, and what businesses can do.

Metin Kortak, CISO with Rhymetec, talks about how organizations are approaching data privacy and security compliance, and thinking about risk management policies, when it comes to generative AI in the workplace.

Michael Mann's 1995 thriller Heat is considered by many people to be the best crime movie ever made. And hidden inside the intricate plot is a story of a lone hacker with a background at DARPA who uses his skills to set up scores for the crews in LA's underworld. Meg Gardiner, the co-author of Heat 2, and Casey Ellis, cofounder of Bugcrowd, join Dennis Fisher to dig into the technological and psychological details of this modern masterpiece. This is Deciphering Heat.Check out Meg's newest thriller, Shadowheart.

Amy Bogac, a longtime security executive with a deep background in systems administration and networking, joins Dennis Fisher to talk about how she came to security, how her background in communications informed her career choices, and the difficult conversations that need to occur before someone has to push the button during an incident. 

A few days after Microsoft announced the new AI-enabled Recall feature--generating tremendous concerns and pushback from the security and privacy communities--the company had decided to disable it by default, but many concerns still remain. A month after the company's CEO proclaimed that it would be "prioritizing security above all else", how did this happen?Satya Nadella's SFI blog.The Microsoft blog post on Recall updates.

Veteran security journalist and podcaster Ryan Naraine joins the Decipher podcast to discuss the challenges of separating fact from fiction when reporting on complex incidents such as the Snowflake breach.

Garrett Yamada, associate director of identity security at Texas A&M University, talks about his experiences navigating identity challenges, building an identity-centric strategy and moving away from “home-grown, home-managed systems” that were historically used for authentication.

Sarah Powazek, the Program Director of Public Interest Cybersecurity at the UC Berkeley Center for Long-Term Cybersecurity, joins Dennis Fisher to talk about her work in setting up Cybersecurity Clinics at high education institutions around the country to help bring knowledge and skills to underserved organizations. 

Caitlin Condon of Rapid7 joins Dennis Fisher to dive into the juicy tidbits from the Rapid7 Attack iNtelligence Report, including the rise in attacks on zero days, ransomware proliferation, and why network edge devices remain a major problem. Read the report here: https://www.rapid7.com/c/fr-2024-attack-intelligence-report-TY/1/

Chris Langford, Director of Network, Infrastructure, and Cyber Security at the Lewisville Independent School District, talks about how having experience in the classroom has helped him from a cybersecurity perspective, and how we can best educate the next generation of students on cybersecurity best practices.

At RSA Conference 2024, Kelly Shortridge, senior director of portfolio product management at Fastly, talks about the first steps organizations can take toward adopting a Secure by Design mindset and how businesses can approach the challenge of sustaining resilience in complex systems.  

In this special episode, Dennis Fisher and Lindsey O'Donnell-Welch are joined by Brian Donohue of Red Canary to preview the RSA conference talks they're excited about and to try to make sense of some of the session titles that are maybe a little indecipherable.

Lindsey O'Donnell-Welch turns the tables on Decipher editor-in-chief Dennis Fisher in this episode of Memory Safe to find out how his background covering crime prepared him for the cybersecurity beat, why Ferris Bueller's Day Off is his favorite hacker movie, and how much the security world has changed in the last 20 years. 

In this week's Source Code podcast, we go over findings from a newly released Ransomware Task Force report and give an update on the types of data accessed in the Change Healthcare ransomware attack.

The Salvation Army's Lachlan McGill, general manager of cyber risk and compliance, and Euan Moore, security operations manager, talk about their experiences building a strong cybersecurity foundation, navigating the organization's unique challenges and fostering a culture around security awareness.

In this week's Source Code podcast, we discuss new reporting from Change Healthcare parent UnitedHealth Group that the massive ransomware attack has cost the company $872 million so far. We also talk about recent research about Sandworm, which has been designated by Mandiant as APT44.

Cody Stokes, a security leader at Procellis Technology, joins Dennis Fisher to talk about his time in the Marine Corps, the challenges of breaking into the cybersecurity field, and the fulfillment he gets from helping to protect users. 

In this week's Memory Safe episode, Sherrod DeGrippo of Microsoft talks about her first experiences with hacker culture, why a Stanley Kubrik movie shows a glimpse of what AI is, and how she makes sure that “threat intelligence hits the right note.”

Dan Lorenc, co-founder and CEO of Chainguard, joins Dennis Fisher to dig into the recent XZ Utils backdoor incident, the implications for the open source ecosystem, and what can be done to avoid similar incidents in the future. Then they discuss the problems facing NIST's National Vulnerability Database and the CVE ecosystem. 

Rick Gordon of Tidal Cyber joins Dennis Fisher to discuss his path from the US Naval Academy to submarine officer to Wall Street and finally to the cybersecurity industry, where he's worked for the last 25 years. Dennis and Rick also talk about the importance of the community aspect of cybersecurity and why it's vital to the collective defense. 

In this week's Source Code news wrap podcast, we talk about a report by the U.S. Treasury Department looking at AI-specific cybersecurity risks in the financial sector, CISA's newly released Notice of Proposed Rulemaking document for the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), and recently discovered activity linked to APT29. 

Jack Cable, senior technical advisor at the Cybersecurity and Infrastructure Security Agency (CISA), talks about his past experiences with bug bounty programs, CISA's Secure By Design initiative and its efforts to help secure the open-source software ecosystem. 

Brian Donohue of Red Canary joins Dennis Fisher to talk about some of the surprising findings from the company's new 2024 Threat Detection Report, including why identity based attacks continue to work so well and how attackers are approaching the shift to the cloud.

In this week's Source Code podcast, we talk about Patch Tuesday updates and the HHS investigation into the ransomware attack on Change Healthcare.

Decipher editors Dennis Fisher and Lindsey O'Donnell-Welch talk about the BlackCat ransomware attack on Change Healthcare that has crippled the company and affected the ability of thousands of health care providers, pharmacies, and hospitals to get paid and submit claims. 

Daniel Cuthbert, global head of cybersecurity research at Banco Santander, joins Dennis Fisher to talk about getting his first computer, a ZX Spectrum that he still owns (!), finding his way into hacking through IRC, his passion for photography, and his surprising alternate career path.

In this week's Source Code podcast we talk about how threat actors are using malware that allows them to maintain a better foothold on compromised Ivanti appliances, and we discuss advisories from the U.S. government about APT28, APT29 and the BlackCat ransomware group.

Alex Delamotte, threat researcher at SentinelLabs, talks about the importance of actionable threat intelligence, how threat actors are leveraging cloud services, and the upcoming Net Gala, a hacker and tech-themed art exhibition. 

In this week's Source Code podcast, we discuss the LockBit ransomware takedown operation and  a critical, actively exploited ScreenConnect flaw. 

Jennifer Leggio, a longtime security industry executive who has served in many different roles, joins Dennis Fisher to talk about the shift in thinking among  those in the security community, technical gatekeeping in security, her new consulting venture Moveable Feast, and finding your niche.

Dennis Fisher and Lindsey O'Donnell-Welch discuss the disruption of the LockBit ransomware operation by the FBI, Europol, and UK authorities, what it means for victims, and how it fits into the government's larger strategy to target cybercrime groups. 

In this week's Source Code podcast we discuss the return of the Bumblebee malware and the DoJ's announcement of a Russian botnet disruption. 

Mick Baccio, global security advisor at SURGe with Splunk, talks about how his perspectives on cybersecurity have changed over time - from first reading Neuromancer at age nine, to acting as the White House threat intelligence branch chief across multiple administrations.

Software security and AI security expert Gary McGraw joins Dennis Fisher to discuss the findings of a new AI architectural risk analysis research paper that his Berryville Institute of Machine Learning did on LLMs, the risks of black box models, and what kind of regulation would be most effective at reducing those risks. 

In this week's Source Code podcast, we discuss a U.S. congressional hearing about the Chinese state-sponsored cyber threats, how CISOs' understanding of operational technology threats is evolving, and the ongoing situation with actively exploited Ivanti vulnerabilities. 

Kevin Tian and Rahhul Madduluri, co-founders of Doppel, join Dennis Fisher to discuss the emerging threats of AI-enabled phishing and brand impersonation and how AI can also be used to detect and stop these attacks.