Podcasts about EDR

In episode 431 of the "Smashing Security" podcast, a self-proclaimed crypto-influencer calling himself CP3O thought he had found a shortcut to riches — by racking up millions in unpaid cloud bills.Meanwhile, we look at the growing threat of EDR-killer tools that can quietly switch off your endpoint protection before an attack even begins.And for something a little different, we peek into the Internet Archive's dystopian Wayforward Machine and take a detour to Mary Shelley's resting place in Bournemouth.All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley, joined this week by special guest Allan "Ransomware Sommelier" Liska.Episode links:Crypto Influencer Sentenced to Prison for Multi-Million Dollar “Cryptojacking” Scheme - US Department of Justice.Ransomware crews don't care about your endpoint security – they've already killed it - The Register.Way Forward Machine - The Internet Archive.Mary Shelley's grave - Atlas Obscura.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Proton Drive - Protect your files with end-to-end encryption in Switzerland's secure cloud — only on Proton Drive.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!FOLLOW US:Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.THANKS:Theme tune: "Vinyl Memories" by Mikael Manvelyan.Assorted sound effects: AudioBlocks.ENJOYED THE SHOW?Make sure to check out our sister podcast, "The AI Fix". Hosted on Acast. See acast.com/privacy for more information.

Crypto Stable coin tricked people out of 40Billion not the creator faces 25 years in prison, Ransomware attackers what to defeat EDR, Volkswagen in UK charging you monthly for more HP, Should I get another HP Envy? Year old Samsung pop-up on my phone, Is your phone Naked? Travel with Wifi / VPN,

Creepy chatbots, Fortinet, CISA, Agentic AI, FIDO, EDR, Aaran Leyland, and More on this episode of the Security Weekly News. Show Notes: https://securityweekly.com/swn-503

Creepy chatbots, Fortinet, CISA, Agentic AI, FIDO, EDR, Aaran Leyland, and More on this episode of the Security Weekly News. Visit https://www.securityweekly.com/swn for all the latest episodes! Show Notes: https://securityweekly.com/swn-503

Stellar Cyber Revolutionizes SOC Cybersecurity Operations with Human-Augmented Autonomous Platform at Black Hat 2025 A Stellar Cyber Event Coverage of Black Hat USA 2025 Las VegasAn ITSPmagazine Brand Story with Subo Guha, Senior Vice President Product, Stellar Cyber____________________________Security operations centers face an unprecedented challenge: thousands of daily alerts overwhelming analyst teams while sophisticated threats demand immediate response. At Black Hat USA 2025 in Las Vegas, Stellar Cyber presented a revolutionary approach that fundamentally reimagines how SOCs operate in the age of AI-driven threats.Speaking with ITSPmagazine's Sean Martin, Subo Guha, Senior Vice President of Products at Stellar Cyber, outlined the company's vision for transforming security operations through their human-augmented autonomous SOC platform. Unlike traditional approaches that simply pile on more automation, Stellar Cyber recognizes that effective security requires intelligent collaboration between AI and human expertise.The platform's three-layer architecture ingests data from any source – network devices, applications, identities, and endpoints – while maintaining vendor neutrality through open EDR integration. Organizations can seamlessly work with CrowdStrike, SentinelOne, Sophos, or other preferred solutions without vendor lock-in. This flexibility proves crucial for enterprises navigating complex security ecosystems where different departments may have invested in various endpoint protection solutions.What sets Stellar Cyber apart is their autonomous SOC concept, which dramatically reduces alert volume from hundreds of thousands to manageable numbers within days rather than weeks. The platform's AI-driven auto-triage capability identifies true positives among thousands of false alarms, presenting analysts with prioritized "verdicts" that demand attention. This transformation addresses one of security operations' most persistent challenges: alert fatigue that leads to missed threats and burned-out analysts.The revolutionary AI Investigator copilot enables natural language interaction, allowing analysts to query the system conversationally. An analyst can simply ask, "Show me all impossible travel incidents between midnight and 4 AM," and receive actionable intelligence immediately. This democratization of security operations means junior analysts can perform at senior levels without extensive coding knowledge or years of experience navigating complex query languages.Identity threat detection and response (ITDR) emerged as another critical focus area during the Black Hat presentation. With identity becoming the new perimeter, Stellar Cyber integrated sophisticated user and entity behavior analytics (UEBA) directly into the platform. The system detects impossible travel scenarios, credential attacks, and lateral movement patterns that indicate compromise. For instance, when a user logs in from Portland at 11 PM and then appears in Moscow 30 minutes later, the platform immediately flags this physical impossibility.The identity protection extends beyond human users to encompass non-human identities, addressing the growing threat of automated attacks powered by large language models. Hackers now leverage generative AI to create credential attacks at unprecedented scale and sophistication, making robust identity security more critical than ever.Guha emphasized that AI augmentation doesn't displace security professionals but elevates them. By automating mundane tasks, analysts focus on strategic decision-making and complex threat hunting. MSSPs report dramatic efficiency gains, scaling operations without proportionally increasing headcount. Where previously a hundred thousand alerts might take weeks to process, requiring extensive junior analyst teams, the platform now delivers actionable insights within days with smaller, more focused teams.The platform's unified approach eliminates tool sprawl, providing CISOs with real-time visualization of their security posture. Executive reporting becomes instantaneous, with high-priority verdicts clearly displayed for rapid decision-making. This visualization capability transforms how security teams communicate with leadership, replacing lengthy reports with dynamic dashboards that convey risk and response status at a glance.Real-world deployments demonstrate significant operational improvements. Organizations report faster mean time to detection and response, reduced false positive rates, and improved analyst satisfaction. The platform's learning capabilities mean it becomes more intelligent over time, adapting to each organization's unique threat landscape and operational patterns.As organizations face increasingly sophisticated threats powered by generative AI, Stellar Cyber's human-augmented approach represents a paradigm shift. By combining AI intelligence with human intuition, the platform delivers faster threat detection, reduced false positives, and empowered security teams ready for tomorrow's challenges. The company's commitment to continuous innovation, evidenced by rapid feature releases between RSA and Black Hat, positions them at the forefront of next-generation security operations. Learn more about Stellar Cyber: https://itspm.ag/stellar-cyber--inc--357947Note: This story contains promotional content. Learn more.Guest: Subo Guha, Senior Vice President Product, Stellar Cyber | https://www.linkedin.com/in/suboguha/ResourcesLearn more and catch more stories from Stellar Cyber: https://www.itspmagazine.com/directory/stellarcyberLearn more and catch more stories from our Black Hat USA 2025 coverage: https://www.itspmagazine.com/bhusa25Learn more about ITSPmagazine Brand Story Podcasts: https://www.itspmagazine.com/purchase-programsNewsletter Archive: https://www.linkedin.com/newsletters/tune-into-the-latest-podcasts-7109347022809309184/Business Newsletter Signup: https://www.itspmagazine.com/itspmagazine-business-updates-sign-upAre you interested in telling your story?https://www.itspmagazine.com/telling-your-story

Researchers uncover multiple vulnerabilities in a popular open-source secrets manager. Software bugs threaten satellite safety. Columbia University confirms a cyberattack. Researchers uncover malicious NPM packages posing as WhatsApp development tools.A new EDR killer tool is being used by multiple ransomware gangs. Home Improvement stores integrate AI license plate readers into their parking lots. The U.S. federal judiciary announces new cybersecurity measures after cyberattacks compromised its case management system. CISA officials reaffirm their commitment to the CVE Program. Our guest is David Wiseman, Vice President of Secure Communications at BlackBerry, discussing the challenges of secure communications. AI watermarking breaks under spectral pressure. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by David Wiseman, Vice President of Secure Communications at BlackBerry, who is discussing the challenges and misconceptions around secure communications. Selected Reading HashiCorp Vault 0-Day Flaws Enable Remote Code Execution Attacks (GB Hackers) Yamcs v5.8.6 Vulnerability Assessment (VisionSpace) Columbia University says hacker stole SSNs and other data of nearly 900,000 (The Record) Fake WhatsApp developer libraries hide destructive data-wiping code (Bleeping Computer) New EDR killer tool used by eight different ransomware groups (Bleeping Computer) Home Depot and Lowe's Share Data From Hundreds of AI Cameras With Cops (404 Media) US Federal Judiciary Tightens Security Following Escalated Cyber-Attacks (Infosecurity Magazine) CISA pledges to continue backing CVE Program after April funding fiasco  (The Record) CISA Issues 10 ICS Advisories Detailing Vulnerabilities and Exploits (GB Hackers) AI Watermark Remover Defeats Top Techniques  (IEEE Spectrum) Audience Survey Complete our annual audience survey before August 31. Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here's our media kit. Contact us at cyberwire@n2k.com to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Parce que… c'est l'épisode 0x616! Shameless plug 12 au 17 octobre 2025 - Objective by the sea v8 10 au 12 novembre 2025 - IAQ - Le Rendez-vous IA Québec 17 au 20 novembre 2025 - European Cyber Week 25 et 26 février 2026 - SéQCure 2065 Description Introduction et contexte Joey D., superviseur d'une équipe de détection au Centre canadien pour la cybersécurité du gouvernement fédéral, présente les défis majeurs auxquels fait face son organisation dans la gestion de la cybersécurité à l'échelle nationale. Lors de sa présentation à NorthSec, il a abordé un problème critique : la pollution causée par le bruit dans les systèmes de détection. Le défi du volume de données Le centre canadien traite un volume impressionnant de données : plus de 200 000 événements par seconde provenant de 167 clients (et plus), couvrant l'ensemble du territoire canadien. Cette télémétrie massive est corrélée avec un grand volume d'indicateurs de compromission provenant de diverses sources et partenariats internationaux. Si cette richesse d'informations constitue un atout considérable, elle génère également un défi majeur : le bruit. La combinaison de ces deux éléments - volume important de télémétrie et grand nombre d'indicateurs - crée une pollution informationnelle qui peut submerger les analystes. Les faux positifs et les mauvaises détections prolifèrent, risquant de masquer de véritables menaces ou de mobiliser inutilement les ressources d'analyse. L'approche de filtrage intelligent Pour résoudre ce problème, Joey et son équipe ont développé une approche basée sur l'identification et la caractérisation de ce qui est “non malicieux”. Plutôt que de simplement bloquer automatiquement les alertes, ils créent des filtres informatifs qui aident les analystes dans leur processus de triage. Cette méthode permet d'éviter les faux négatifs, où un véritable compromis pourrait être filtré par erreur. L'équipe préfère maintenir un niveau de prudence élevé. Comme l'explique Joey : “À un moment donné, nous, on n'aime pas prendre ce risque-là de manquer un vrai événement de compromission.” Les filtres automatisés sont donc principalement informatifs, bien que certains, lorsque l'équipe a une confiance élevée, puissent déclencher des actions automatisées. Le cas des administrateurs créatifs Un exemple particulièrement intéressant concerne les administrateurs système. Ces professionnels, dotés de privilèges élevés sur les réseaux, font parfois preuve d'une créativité remarquable dans l'accomplissement de leur travail. Ils peuvent utiliser des outils ou des techniques habituellement associés à des acteurs malveillants, mais dans un contexte parfaitement légitime. Cette créativité administrative pose un défi constant : comment distinguer une technique légitime d'une utilisation malveillante ? L'équipe de Joey a développé plusieurs approches pour gérer ce problème, allant de filtres très spécifiques (par exemple, tel script exécuté par tel utilisateur à telle heure) à des filtres plus génériques basés sur la compréhension des technologies. L'étude du système Delivery Optimization Joey a mené une étude approfondie du système Delivery Optimization de Microsoft, un service de partage de fichiers présent par défaut sur tous les appareils Windows depuis Windows 10. Ce système permet d'accélérer les mises à jour en utilisant un mécanisme de peer-to-peer au sein du réseau local, réduisant ainsi la bande passante utilisée vers les serveurs Microsoft. Le problème survient lorsque ce système est configuré pour partager avec des machines sur Internet plutôt que seulement sur le réseau local. Dans un contexte de télétravail, cela peut créer des connexions vers des adresses IP dans différents pays, générant des alertes suspectes pour les analystes qui voient des transferts de données importants vers des destinations potentiellement douteuses. Cette recherche illustre parfaitement l'importance de comprendre le fonctionnement normal des systèmes pour mieux détecter les anomalies. Comme le souligne Joey, peu de chercheurs en sécurité s'intéressent à ces mécanismes non malveillants, créant un angle mort dans la détection. La corrélation multi-sources Une des forces du système développé par l'équipe réside dans sa capacité à corréler différents types de télémétrie. En combinant les données réseau (NetFlow, captures de paquets) avec les données d'endpoints (EDR), ils peuvent obtenir un contexte beaucoup plus riche pour leurs analyses. Par exemple, dans le cas des “fake captchas” - ces pages web malveillantes qui demandent aux utilisateurs d'exécuter des commandes via Windows+R et Ctrl+V - la corrélation permet de faire la distinction entre une simple visite du domaine malveillant (comportement normal) et l'exécution effective de la chaîne de processus malveillante (comportement à investiguer). L'architecture de détection à plusieurs niveaux Le système développé par l'équipe fonctionne selon une architecture sophistiquée à plusieurs niveaux. Au niveau le plus bas, on trouve les “hits” - des événements détectés qui ne nécessitent pas nécessairement l'intervention humaine. Par exemple, l'exécution de la commande “ping” génère un hit, mais celui-ci n'est traité que par des algorithmes. Ces hits peuvent être “promus” en alertes lorsque des algorithmes détectent des patterns suspects - par exemple, une séquence ping-ping-ping suivie de “whoami”. À l'inverse, certaines détections génèrent directement des alertes en raison de leur gravité (comme PowerShell téléchargeant du contenu depuis Internet après l'ouverture d'un document Word). Le système inclut également des algorithmes de “démotion” qui peuvent reclasser une alerte en hit lorsqu'il s'avère qu'elle correspond à un comportement légitime d'un administrateur système connu. L'intégration des indicateurs de compromission L'intégration des feeds de threat intelligence (comme MISP) représente un défi particulier. Ces indicateurs, souvent rudimentaires, nécessitent un travail important de contextualisation. Plusieurs équipes au Centre Canadien pour la cybersécurité ajoutent systématiquement du contexte lors de l'ingestion : si un fournisseur ne livre que des adresses IP mais que tous ses indicateurs concernent des botnets, cette information contextuelle est ajoutée automatiquement. Cette approche permet aux analystes de disposer du contexte nécessaire dès le moment du triage, améliorant significativement l'efficacité du processus d'analyse. Les défis de la contextualisation La contextualisation des indicateurs présente plusieurs difficultés. Les concepts peuvent être contradictoires entre différentes sources, la temporalité joue un rôle crucial (un indicateur valide il y a deux semaines peut ne plus l'être aujourd'hui), et la géolocalisation peut être trompeuse, notamment lorsque des acteurs malveillants utilisent des routeurs compromis pour masquer leur origine réelle. L'équipe doit constamment évaluer son appétit au risque pour déterminer quels indicateurs méritent une investigation et lesquels peuvent être filtrés sans risque. Les bénéfices pour les citoyens Au-delà de la protection des infrastructures gouvernementales, le travail de l'équipe de Joey bénéficie directement aux citoyens canadiens. Grâce à un partenariat avec CIRA (l'organisme responsable du domaine .ca), les indicateurs de compromission identifiés par le centre sont intégrés au service Canadian Shield. Ce service DNS gratuit permet à tout citoyen de bénéficier de cette protection en configurant simplement son routeur domestique. Conclusion et enseignements Le travail présenté par Joey D. illustre l'importance d'investir dans la qualité des données en amont du processus de détection Plutôt que de déployer des solutions “out-of-the-box” et de s'en contenter, son équipe démontre qu'un investissement significatif dans la compréhension, la contextualisation et le filtrage intelligent des données peut transformer radicalement l'efficacité d'un SOC. L'approche développée au Centre canadien pour la cybersécurité offre un modèle inspirant pour d'autres organisations confrontées aux mêmes défis de volume et de bruit. En se concentrant sur la caractérisation du comportement normal et en développant des systèmes de corrélation sophistiqués, il devient possible de gérer efficacement des volumes de données considérables tout en maintenant un niveau de détection élevé. Cette présentation souligne également l'importance de la collaboration et du partage d'informations dans le domaine de la cybersécurité, démontrant comment le travail d'une équipe gouvernementale peut bénéficier à l'ensemble de la communauté, des grandes organisations aux citoyens individuels. Notes Le Bouclier canadien Collaborateurs Joey D. Crédits Montage par Intrasecure inc Locaux réels par Northsec

All links and images can be found on CISO Series. This week's episode is hosted by me, David Spark, producer of CISO Series and Mike Johnson, CISO, Rivian. Joining us is our sponsored guest, Rob Allen, chief product officer, ThreatLocker. In this episode: Large enterprise security demands drive vendor improvements Technical expertise becomes leadership liability without delegation EDR evolution needs prevention focus Career breaks require personal ownership and strategic timing A huge thanks to our sponsor, ThreatLocker ThreatLocker® is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com.

“Detection is not the end—it's just the beginning.” — Jerry Mancini, NETSCOUT In this episode of Technology Reseller News, Publisher Doug Green speaks with Jerry Mancini of NETSCOUT about the company's latest advancements in automated threat detection and response—with a particular focus on why telecommunications networks are uniquely vulnerable and high-value targets. NETSCOUT, long known for its deep packet inspection and network performance management, is expanding the capabilities of its adaptive threat analytics—a platform designed not only to detect threats but also to assemble and contextualize them using network-level intelligence. Beyond Detection: Seeing the Full Picture While most cybersecurity tools focus on isolated detections—EDR, firewall logs, and suspicious indicators—NETSCOUT's approach centers on reconstructing the complete threat narrative across the enterprise. By capturing packet data continuously and using workflows to connect disparate detections, NETSCOUT enables investigators to: Understand the root cause and lateral movement Detect activity before and after a flagged incident Integrate signals from multiple sources (EDR, NDR, WAF, and more) Investigate threats in real time and retrospectively Why Telcos Are at Greater Risk Mancini highlights the unique role of telco infrastructure in global data movement, making them prime targets for cyber espionage and traffic manipulation. Attackers, such as the Salt Typhoon group, have used compromised routers and peering points to reroute and eavesdrop on massive data flows—impacting not just carriers but their customers across the internet. Best Practices for Threat Hunters NETSCOUT supports both bottom-up investigations (starting with a detected incident) and top-down threat hunts (searching for indicators tied to known campaigns). The platform's ability to store and search packet-level data gives teams visibility that goes far beyond typical log-based detection tools. Mancini's key advice: “You need more than alerts—you need the data to trace back, understand what happened, and act before it's too late.” Where to Learn More Visit netscout.com to explore solutions in: Network Performance Management DDoS Detection & Mitigation Adaptive Threat Analytics NETSCOUT supports both enterprise and service provider environments and is available to assist with immediate and long-term threat management strategies.

In this special live episode of Autonomous IT, Live! we walk through a high-stakes incident response drill that mimics a disturbingly realistic threat scenario: an attacker gains access to your internal tools — not by breaking in, but by logging in.Here's the setup: a user unknowingly reuses compromised credentials with the company's SSO provider. An attacker logs in, flies under the radar, and impersonates internal IT support using Slack, email, and calendar invites. Their goal? Convince employees to install a fake remote access tool—all while avoiding anyone likely to report suspicious behavior.Join Landon Miles, Tom Bowyer, and Ryan Braunstein as they:

Parce que… c'est l'épisode 0x610! Shameless plug 12 au 17 octobre 2025 - Objective by the sea v8 10 au 12 novembre 2025 - IAQ - Le Rendez-vous IA Québec 17 au 20 novembre 2025 - European Cyber Week 25 et 26 février 2026 - SéQCure 2026 Description Introduction et contexte Dans cet épisode technique du podcast, les participants explorent les défis complexes de l'implémentation des technologies de télémétrie de sécurité dans les environnements de technologie opérationnelle (OT). Ils abordent particulièrement la transposition des concepts familiers du monde IT, comme les EDR (Endpoint Detection and Response), XDR (Extended Detection and Response) et NDR (Network Detection and Response), vers l'univers industriel. Les fondements de la télémétrie de sécurité Les technologies de détection et de réponse reposent sur deux piliers principaux : la détection (génération de télémétrie intelligente) et la réponse (capacité d'intervention automatisée). Du côté IT, ces systèmes permettent d'intervenir sur les terminaux en les isolant ou en bloquant certaines actions, tandis qu'au niveau réseau, ils peuvent bloquer le trafic identifié comme malveillant. Cette approche, bien maîtrisée en IT, pose des défis considérables lorsqu'elle est transposée dans les environnements OT. Les défis spécifiques à l'environnement OT L'installation d'un EDR sur un automate industriel s'avère impossible, contrairement à un poste Windows traditionnel. Les équipements industriels génèrent une télémétrie primaire et limitée, rendant difficile l'extraction de signaux de sécurité pertinents. Les experts recommandent de se concentrer sur les actifs plus évolués fonctionnant sous Windows ou Linux, car la majorité des attaquants privilégient ces plateformes familières plutôt que les systèmes industriels propriétaires. Cette approche s'appuie sur la “théorie du 99%”, qui stipule que les actifs IT ont une capacité de défense autonome contrairement aux actifs OT. Les attaques sophistiquées ciblant directement les systèmes industriels, comme Stuxnet ou Triton, demeurent exceptionnelles avec seulement quatre cas documentés en vingt ans. La plupart des incidents se limitent au niveau 3 du modèle de référence industriel, où se trouvent les serveurs et stations de travail Windows. L'enjeu patrimonial et la durée de vie des équipements L'environnement OT présente une caractéristique unique : la longévité exceptionnelle des équipements. Contrairement au monde IT où les systèmes sont régulièrement renouvelés, les installations industrielles peuvent fonctionner pendant 40 ans. Cette durée de vie étendue s'explique par les coûts élevés des équipements (plusieurs millions par pièce) et leur cycle de vie utile prolongé, particulièrement dans des secteurs comme la santé. Cette situation crée des défis de sécurité considérables, certaines installations fonctionnant encore sur des systèmes obsolètes comme Windows 3.11 ou NT4. Les organisations développent parfois des solutions de contournement, comme l'isolement par air gap et la réinstallation périodique des stations de travail pour gérer les infections persistantes. Complexité d'implémentation des EDR en OT L'implémentation d'EDR dans l'environnement OT nécessite une analyse de risque approfondie. Le confinement automatique, fonction standard des EDR, peut s'avérer catastrophique dans un contexte industriel. Les experts rapportent des incidents où un fichier de programmation d'automate (ladder logic) a été incorrectement identifié comme malveillant, provoquant le confinement automatique d'un serveur critique. La configuration des EDR en OT exige une adaptation minutieuse, notamment la désactivation des fonctions de réponse automatique. De plus, ces systèmes demandent des ressources significatives et ne peuvent pas être déployés sur des serveurs déjà saturés ou ayant des capacités limitées, situation fréquente dans l'industrie. Défis de la télémétrie personnalisée Contrairement aux systèmes IT où les événements sont standardisés, les automatismes industriels génèrent une télémétrie sur mesure. Il existe peu d'experts capables d'interpréter les signaux industriels pour détecter des anomalies sécuritaires. Cette analyse nécessite généralement l'expertise d'ingénieurs de procédé familiers avec les systèmes spécifiques. Les solutions de surveillance passive existent mais requièrent un investissement considérable en configuration et en compréhension de l'environnement. L'établissement d'une baseline de trafic normal peut prendre près d'un an de travail pour atteindre un niveau de visibilité comparable à celui obtenu en IT. Architecture et cloisonnement réseau Le transfert des signaux OT vers les consoles IT pose des défis architecturaux majeurs. Les environnements industriels sont généralement cloisonnés, nécessitant la création de pipelines d'ingestion de données complexes. Ces systèmes de relais permettent de traverser les barrières réseau tout en maintenant la sécurité, mais rendent les projets de visibilité particulièrement laborieux. La remontée des signaux vers une console de sécurité unifiée nécessite souvent une infrastructure dédiée côté OT, créant un “réseau dans le réseau” pour observer les systèmes cloisonnés depuis l'extérieur. Contraintes des fournisseurs et garanties Les fournisseurs d'équipements industriels imposent souvent des restrictions strictes sur les solutions de sécurité autorisées. Dans les installations récentes sous garantie, seules certaines solutions approuvées peuvent être déployées. Le non-respect de ces contraintes peut entraîner l'annulation de garanties couvrant parfois 10 à 15 ans d'exploitation. Cette situation oblige les organisations à valider toute solution de sécurité en laboratoire avant le déploiement, avec une représentation miniature de l'environnement de production. Certains éditeurs d'EDR montrent peu d'affinité avec les environnements cloisonnés, privilégiant des approches IT traditionnelles. Évolution vers le cloud et nouveaux paradigmes L'industrie OT évolue progressivement vers des solutions cloud, même pour les scanners passifs traditionnellement conçus pour des environnements isolés. Cette transition soulève des questions sur l'ouverture contrôlée d'accès Internet dans les couches basses du modèle de Purdue, remettant en question l'isolement total historiquement privilégié. Les solutions modernes nécessitent un flux continu de renseignements sur les menaces pour détecter efficacement les menaces émergentes. Le transport traditionnel de signatures s'avère trop lent face à l'évolution rapide des cybermenaces. Perspectives et recommandations Les experts recommandent de se concentrer sur la consolidation des journaux Windows et des événements SNMP comme point de départ pour améliorer la visibilité. Cette approche pragmatique permet d'obtenir rapidement des gains significatifs dans des environnements actuellement dépourvus de toute visibilité sécuritaire. L'implémentation réussie de ces technologies requiert une collaboration étroite entre les équipes IT et OT, traditionnellement en tension. La cybersécurité en OT doit être perçue comme un mode de défaillance supplémentaire à surveiller, au même titre que les paramètres opérationnels traditionnels. Conclusion L'adaptation des technologies xDR aux environnements OT représente un défi multifacette nécessitant une approche sur mesure. Bien que les concepts IT puissent servir de base, leur transposition directe s'avère inadéquate. Le succès dépend d'une compréhension fine des contraintes industrielles, d'une analyse de risque rigoureuse et d'une architecture respectant les impératifs de sécurité et de continuité opérationnelle. L'évolution vers une visibilité sécuritaire complète en OT demeure un processus long et complexe, mais nécessaire face à l'évolution des menaces cybernétiques. Collaborateurs Nicolas-Loïc Fortin Steve Bélanger Camille Felx Leduc Crédits Montage par Intrasecure inc Locaux virtuels par Riverside.fm

Az előfizetők (de csak a Belső kör és Közösség csomagok tulajdonosai!) már szombat hajnalban hozzájutnak legfrissebb epizódunk teljes verziójához. A hétfőn publikált, ingyen meghallgatható verzió tíz perccel rövidebb. Itt írtunk arról, hogy tudod meghallgatni a teljes adást. A futball Liam Gallaghere. A XXI. század Czinege Lajosa. Anikó igényei. Orbán unokája. Trump Patriotja. A focista Lamborghinije. Almák matricái, kenyerek cetlijei. Winkler morális pillanata. 00:54 Médiatörténelem: lehet podcastolni Tour de France-bámulás közben. Az Oasis cardiffi visszatérése crowdsource-olva. A Beastie Boys filmje, amit tényleg Adam MCA Yauch rendezett. A futballpályák Liam Gallaghere. Urbán Flórián és Zlatan Ibrahimovic. 05:31 Zlatan XTB-t reklámoz. Különböző balkáni arcberendezések. Vennél használt autót Zlatantól? Bernard Hinault Skodát reklámoz. Amikor Tom Simpson amfetaminokkal és alkohollal teletömve meghalt a biciklin. 10:50 Kvíz 1: Ruszin-Szendi és Dr. Szöszi. Kvíz 2: Honnan tudja Uj Péter, hogy mikor járt le Winkler Róbert halszósza? Kvíz 3: Vállalási tasak. Kvíz 4: Romina és Ronett. 17:13 Ruszin-Szendi Romulusz palotájának részletei. A magyar honvédség lakberendezési hagyományai. Czinege Lajos palotája az Edrődi Sándor utca 18/B-ben. 21:58 Czinege, az érdekes figura. 24:52 Melyik a legszarabb ház Dunakeszin? Mennyibe kerül egy magaságyás? A grillezés Stradivarija. Mikor ástál utoljára emésztőgödröt? 29:49 Bőrgarnitúra, 18 étkezőszék, Nespresso-csészék. Vegyenek már egy rendes Kees van der Westent! Anikó asszony igényei. 34:13 Ez már nem az a Ruszin-Szendi és nem az a Magyar. Várjuk a további feleségek listáit! Megvehették volna a Gellértet is. 37:49 Miért nem tiltja a szerződésük a 390 kilométer per órát? José Antonio Reyes halála. Luc Longley bodyboard-sérülése. 42:07 Az almamatricák és kenyércetlik pokla. 46:51 Hogyan lássunk el fiatalokat minőségi alkohollal? See omnystudio.com/listener for privacy information.

Bob Burke, Chief Information Security Officer at Beyond Identity, challenges the effectiveness of traditional multi-factor authentication (MFA) in the evolving landscape of cybersecurity. He argues that legacy MFA solutions, which often rely on out-of-band authorization methods like push notifications or one-time passwords, are no longer sufficient against the rising tide of sophisticated cyber threats. With the advent of services like phishing-as-a-service, attackers can easily bypass these outdated security measures, necessitating a shift towards phishing-resistant authentication methods. Burke emphasizes the need for organizations to adopt solutions that not only enhance security but also consider device posture and trustworthiness.Burke also critiques the current state of FIDO2 and passkeys, acknowledging their potential while highlighting their limitations, particularly in terms of device posture and user experience. He suggests that small to mid-sized businesses (SMBs) should prioritize phishing-resistant solutions that integrate both browser protection and device authentication. Furthermore, he raises concerns about the pricing models of many Software as a Service (SaaS) providers, which often place essential security features behind higher-tier subscriptions, effectively discouraging customers from adopting more secure practices.The conversation shifts to the endpoint detection and response (EDR) market, where Burke notes that while EDR solutions are still necessary, they are evolving into more comprehensive offerings like extended detection and response (XDR). He points out that many of these solutions are priced for enterprise-level organizations, leaving SMBs and mid-market companies struggling to find affordable options. Burke encourages these organizations to seek out solutions that fit their budget while still providing essential security capabilities.Finally, Burke shares insights from his experience with the FedRAMP certification process, emphasizing the importance of building internal security competencies and integrating security into product design from the outset. He advocates for a clear internal compliance program, such as NIST, to guide organizations in their security efforts. As the cybersecurity landscape continues to evolve, Burke warns that the tempo and scope of attacks are increasing, driven by advancements in AI, and urges organizations to reassess their security architectures to stay ahead of emerging threats.  All our Sponsors: https://businessof.tech/sponsors/ Do you want the show on your podcast app or the written versions of the stories? Subscribe to the Business of Tech: https://www.businessof.tech/subscribe/Looking for a link from the stories? The entire script of the show, with links to articles, are posted in each story on https://www.businessof.tech/ Support the show on Patreon: https://patreon.com/mspradio/ Want to be a guest on Business of Tech: Daily 10-Minute IT Services Insights? Send Dave Sobel a message on PodMatch, here: https://www.podmatch.com/hostdetailpreview/businessoftech Want our stuff? Cool Merch? Wear “Why Do We Care?” - Visit https://mspradio.myspreadshop.com Follow us on:LinkedIn: https://www.linkedin.com/company/28908079/YouTube: https://youtube.com/mspradio/Facebook: https://www.facebook.com/mspradionews/Instagram: https://www.instagram.com/mspradio/TikTok: https://www.tiktok.com/@businessoftechBluesky: https://bsky.app/profile/businessof.tech

What a busy swinger season we are having! Butts bday and after parties and pool parties! What kinda trouble can we get into??Upcoming parties:July 11-13th - EDR time!!!July 26th - LS party with The Goodies in OB San DiegoAug 1 - Say Less MandG at The CoveCome join us on our journey into the lifestyle as a longtime married couple living in Southern California!Call or text us on our Sweet phone at 951-226-5261Contact us:TheSweetSideOfLifePodcast@outlook.comTikTok:https://www.tiktok.com/@sweetsideoflifepodcast?_t=8f44ltzMqMA&_r=1Twitter(X):@SweetSidePodUse my Bluechew referral code LHAS

Send us a textWould you board a flight if the pilot landed safely only 99.5% of the time? Ricardo Villadiego wouldn't—and he applies that same mindset to cybersecurity. In this high-impact episode from IT Nation Secure 2025, Joey Pinz talks with Ricardo, founder of Lumu, about precision, preparation, and protecting MSPs from EDR evasion and network breaches.✈️ Drawing parallels between aviation and cybersecurity, Ricardo shares how checklists, training, and feedback loops apply to both flying planes and defending networks. He recalls lessons from the Miracle on the Hudson and explains why being “left of boom” isn't optional—it's essential.

We had a great time at Athenas and met some new friends. Introducing "Sweet and sour" to the mix! Ice cream butt shenanigans and also talked about some ways to introduce your relationship into the swinging community!Upcoming parties:June 27th - Bday party for Butt at Wine and Beer garden in TemeculaJuly 5th - Saturday FundayJuly 11-13th - EDR time!!!July 26th - LS party with The Goodies in OB San DiegoCome join us on our journey into the lifestyle as a longtime married couple living in Southern California!Call or text us on our Sweet phone at 951-226-5261Contact us:TheSweetSideOfLifePodcast@outlook.comTikTok:https://www.tiktok.com/@sweetsideoflifepodcast?_t=8f44ltzMqMA&_r=1Twitter(X):@SweetSidePodUse my Bluechew referral code LHAS

(Replay) In this episode, Spencer and Brad discuss the ever popular and highly debated topic of evasion. In this podcast we talk about evasion from the context of evading defense controls, not necessarily EDR specific evasion techniques. Our hope with this episode is to shed light on this topic and help defenders understand various methods of evasion and this topic more in general.Resources(Jun 1, 2021) Evadere Classifications - detection & response focusDefense Evasion, Tactic TA0005 - Enterprise | MITRE ATT&CK® - controls focus(Mar 22, 2024) Atomics on a Friday - Evade or Bypass - edr focusBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇Spencer's Links: https://go.spenceralessi.com/mylinks Work with Us: https://securit360.com

Send us a textTodays episode vocers a comprehensive overview of Network Detection and Response (NDR) technology, explaining its core function in detecting abnormal and malicious system behaviors by analyzing network traffic data. It outlines key features such as data ingestion, detection, and response, and discusses common use cases including lateral movement and insider threat detection, even extending to Operational Technology (OT) environments. The text also reviews the current market vendors based on a Gartner Magic Quadrant analysis, differentiates NDR from other security technologies like EDR, SIM, and XDR, and explores the integration of AI in enhancing NDR capabilities.Support the showGoogle Drive link for Podcast content:https://drive.google.com/drive/folders/10vmcQ-oqqFDPojywrfYousPcqhvisnkoMy Profile on LinkedIn: https://www.linkedin.com/in/prashantmishra11/Youtube Channnel : https://www.youtube.com/@TheCybermanShow Twitter handle https://twitter.com/prashant_cyber PS: The views are my own and dont reflect any views from my employer.

Connect to John Gilroy on LinkedIn   https://www.linkedin.com/in/john-gilroy/ Want to listen to other episodes? www.Federaltechpodcast.com Sometimes, one plus one is three. Back in 2021, McAfee's Enterprise business merged with FireEye to form Trellix. Today, the net result is a company that generates $1.2 billion globally and $400 million in the public sector. In today's interview, Ken Karsten details how federal leaders can use Trellix to improve cybersecurity in a federal world with rapidly increasing end points. Setting the stage, Ken Karsten reviews an Executive Order 14028  from 2021 that encouraged federal agencies to aggressively protect endpoints, sometimes called Endpoint Detection and Response. In four short years, AI has transformed the way malicious actors attack end points and the defense had to be improved. Enter, Extended Detection and response. During the interview, Ken Karsten gives listeners an overview of XDR's continuous monitoring, advanced analytics, and rapid threat assessment and response capabilities. Advances in AI have allowed Trellix to deliver EDR and XDR capabilities at a drastically reduced cost. Topics in the discussion include Operational Technology, 5G, and Trellix's recent DoD IL5 authorization. Provide a link to download the Trellix Cyber Threat Report.

I used to think of my car as just a tool to get from point A to point B. But after this conversation, I can't help but see it as something else entirely, a powerful data collection device that knows far more about me than I realized. From where I go and who I text to how I drive and even what's on my phone, today's vehicles are gathering a staggering amount of personal information. In this episode, I talk with Andrea Amico, the founder of Privacy4Cars. Andrea is one of the leading voices in automotive data privacy and someone who's spent years uncovering the hidden ways cars collect, store, and share our information. He breaks down how connected cars work, what's actually being tracked, and why it matters not just for your privacy, but for your safety and finances too. We get into everything from rental car risks and data left behind when you sell a car, to how automakers and third parties might be profiting off your data without your knowledge. If you've ever paired your phone with a vehicle or assumed your texts disappear when you disconnect, this episode is going to change the way you think about driving and how to take back control. Show Notes: [01:28] Andrea started Privacy4Cars because cars collect a lot of data. There were zero protections for privacy and security. He's dedicated to turning your car into a more private space and giving you more choice, understanding, and control. [02:25] We talk about when cars started collecting data. OnStar started about 25 years ago. Things really began to evolve when Bluetooth and navigation became common. [03:12] Things really exploded with modern telematics which is like putting a cell phone inside your car that calls home all the time. The average car collects around 25 GB of data per day. [04:08] We talk about the type of data that is collected by cars from GPS to having your phone collected and the car even knowing your weight. [05:26] The sensors in your car know exactly how you drive. [06:46] Informed consumers are better off. These data collecting policies are usually hidden in the car manufacturers privacy policies. [08:46] You can find your car's privacy policy at Vehicle Privacy Report. [10:21] The goal is to make the car manufacturer's behavior visible to consumers, because that's the way to drive better company behavior. [11:26] When you rent a car and when you sell a car, your car is like a giant unencrypted hard drive that contains your data. [12:06] We should wipe the data in our cars the same way we wipe the data in our phones when we replace them. [13:05] You can find a tool to help remove data from your car at Privacy4Cars. [14:21] We talk about what rental cars get from your connected phone.  [17:24] Found data can be used in targeted spear phishing attacks. [19:18] Most cars since 2017 have a SIM card. If a prior owner consented to data collection, that data is still being collected when you take over the car. [22:15] Ford estimated that they would make $2,000 per car per year from data services. [24:17] It's common for cars to even have a camera that looks at you. In a few years it might be common for vehicles to monitor for things like intoxication. [26:56] Organizations creating standards like the Future of Privacy Forum. [29:09] Cars have an EDR electronic data recorder. It's like a black box for when an accident happens. [34:05] Delete data when you buy, rent, or sell a car. Opt out if you can. [36:33] Think about your car just like your computers and your phone. [37:15] Andrea shares a story about how an ex-spouse was able to duplicate her key. The dealer wanted $1,000 to reset her car. [40:23] Parting advice includes looking up your car's VIN at Vehicle Privacy Report. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.  Links and Resources: Podcast Web Page Facebook Page whatismyipaddress.com Easy Prey on Instagram Easy Prey on Twitter Easy Prey on LinkedIn Easy Prey on YouTube Easy Prey on Pinterest Andrea Amico - Privacy4Cars Privacy4Cars Vehicle Privacy Report Andrea Amico - LinkedIn Future of Privacy Forum Endpoints-On-Wheels – Protecting Company And Employee Data In Cars. Ciso Mitigation Strategies For Fleets, Rentals, And Personnel-Owned Vehicles

OctoSQL & Vulnerability Data OctoSQL is a neat tool to query files in different formats using SQL. This can, for example, be used to query the JSON vulnerability files from CISA or NVD and create interesting joins between different files. https://isc.sans.edu/diary/OctoSQL+Vulnerability+Data/32026 Mirai vs. Wazuh The Mirai botnet has now been observed exploiting a vulnerability in the open-source EDR tool Wazuh. https://www.akamai.com/blog/security-research/botnets-flaw-mirai-spreads-through-wazuh-vulnerability DNS4EU The European Union created its own public recursive resolver to offer a public resolver compliant with European privacy laws. This resolver is currently operated by ENISA, but the intent is to have a commercial entity operate and support it by a commercial entity. https://www.joindns4.eu/ WordPress FAIR Package Manager Recent legal issues around different WordPress-related entities have made it more difficult to maintain diverse sources of WordPress plugins. With WordPress plugins usually being responsible for many of the security issues, the Linux Foundation has come forward to support the FAIR Package Manager, a tool intended to simplify the management of WordPress packages. https://github.com/fairpm

Two parts to this episode: Tech Segment: Updating Linux Systems - Beyond apt-get upgrade * Custom scripts for ensuring your Linux systems are up-to-date * topgrade - tutorial for using topgrade to update Linux systems on various Linux distributions Discussion Topic: Anti-Malware and/or EDR on Linux Platforms * PCI calls for scanning Linux systems * What tools exist for analyzing Linux systems? (AIDE, uac, chkrootkit) * Best Anti-Malware for Linux - Commercial tools, open-source, both, none? * ClamAV - fa-notify and the dangers Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-877

Two parts to this episode: Tech Segment: Updating Linux Systems - Beyond apt-get upgrade * Custom scripts for ensuring your Linux systems are up-to-date * topgrade - tutorial for using topgrade to update Linux systems on various Linux distributions Discussion Topic: Anti-Malware and/or EDR on Linux Platforms * PCI calls for scanning Linux systems * What tools exist for analyzing Linux systems? (AIDE, uac, chkrootkit) * Best Anti-Malware for Linux - Commercial tools, open-source, both, none? * ClamAV - fa-notify and the dangers Show Notes: https://securityweekly.com/psw-877

Two parts to this episode: Tech Segment: Updating Linux Systems - Beyond apt-get upgrade * Custom scripts for ensuring your Linux systems are up-to-date * topgrade - tutorial for using topgrade to update Linux systems on various Linux distributions Discussion Topic: Anti-Malware and/or EDR on Linux Platforms * PCI calls for scanning Linux systems * What tools exist for analyzing Linux systems? (AIDE, uac, chkrootkit) * Best Anti-Malware for Linux - Commercial tools, open-source, both, none? * ClamAV - fa-notify and the dangers Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-877

Two parts to this episode: Tech Segment: Updating Linux Systems - Beyond apt-get upgrade * Custom scripts for ensuring your Linux systems are up-to-date * topgrade - tutorial for using topgrade to update Linux systems on various Linux distributions Discussion Topic: Anti-Malware and/or EDR on Linux Platforms * PCI calls for scanning Linux systems * What tools exist for analyzing Linux systems? (AIDE, uac, chkrootkit) * Best Anti-Malware for Linux - Commercial tools, open-source, both, none? * ClamAV - fa-notify and the dangers Show Notes: https://securityweekly.com/psw-877

Round two of the World Cup Downhill series has delivered with plenty of drama! Join Kieran Bennett, Lester Perry and James Rennie to dive into the Loudenvielle World Cup and all of the drama that came with maybe the fastest track we have seen in quite some time. Some side tracks are taken into the Nove Mesto XC World Cup, Unbound gravel and EDR, along with some completely random tangents that we all know you love.Brought to you by:Maxxis Tyres - New Zealand's tyre of choice!To see the full line up from Maxxis, check out www.marleen.co.nz/brands/maxxis.htmlFox Suspensionhttps://ridefox.com/pages/bikeIf you enjoy the OTB Podcast and would like to support, please consider joining us on Patreon and help keep the podcast alive. This isn't even close to a job for us and is done for your enjoyment! https://www.patreon.com/TheOTBPodcast

Enduro is back and it feels like it might be turning a corner. After a couple of tough seasons, there's a real sense of momentum building in the sport, and we're here for it. In this episode, I'm joined by Greg Callaghan and Morgane Charre, two riders who've been at the sharp end of Enduro racing for years, to dig into the first two rounds of the 2025 EDR season. We're talking big changes: the return of two-day racing, a fresh energy in the pits, and a crop of new talent shaking things up. Greg and Morgane share their experiences from Pietra and Poland so we get the low down on what went on. We get into everything from course design and recovery strategies to weather chaos, injuries, and the impact of a brand new documentary series that's got people talking. There's still a way to go, but if the start of the season is anything to go by, Enduro's future is looking a whole lot brighter. So it's time to sit back, hit play and listen to this episode with Morgane Charre and Greg Callaghan. You can also watch this episode on YouTube here. You can follow Morgane on Instagram @morganecharre. Greg is @greg_callaghan on Instagram and you can find his YouTube channel here. To be in with the chance of winning a set of Magura Gustav Pros and a Wahoo ELEMNT BOLT bike computer, fill out our audience survey here before the end of June 2025. Podcast Stuff Supporting Partners Magura With the new Gustav Pro, Magura have produced the ultimate gravity and ebike brake. With all the power you could ever need, delivered with incredible modulation, you never need to question your brakes again. Head to magura.com and check them out. Wahoo Head to wahoofitness.com to check out Wahoo's brand new ELEMNT BOLT and ROAM bike computers. From tracking your rides, through navigation, to sharing the results, Wahoo have got you covered with easy to use, lightweight computers with incredible battery life. Listener Offers Downtime listeners can now get 10% off of Stashed Space Rails. Stashed is the ultimate way to sort your bike storage. Their clever design means you can get way more bikes into the same space and easily access whichever one you want to ride that day. If you have 2 or more bikes in your garage, they are definitely worth checking out. Just head to stashedproducts.com/downtime and use the code DOWNTIME at the checkout for 10% off your entire order. And just so you know, we get 10% of the sale too, so it's a win win. Patreon I would love it if you were able to support the podcast via a regular Patreon donation. Donations start from as little as £3 per month. That's less than £1 per episode and less than the price of a take away coffee. Every little counts and these donations will really help me keep the podcast going and hopefully take it to the next level. To help out, head here. Merch If you want to support the podcast and represent, then my webstore is the place to head. All products are 100% organic, shipped without plastics, and made with a supply chain that's using renewable energy. We now also have local manufacture for most products in the US as well as the UK. So check it out now over at downtimepodcast.com/shop. Newsletter If you want a bit more Downtime in your life, then you can join my newsletter where I'll provide you with a bit of behind the scenes info on the podcast, interesting bits and pieces from around the mountain bike world, some mini-reviews of products that I've been using and like, partner offers and more. You can do that over at downtimepodcast.com/newsletter. Follow Us Give us a follow on Instagram @downtimepodcast or Facebook @downtimepodcast to keep up to date and chat in the comments. For everything video, including riding videos, bike checks and more, subscribe over at youtube.com/downtimemountainbikepodcast. Are you enjoying the podcast? If so, then don't forget to follow it. Episodes will get delivered to your device as soon as it's available an...

This week, we are joined by Deepen Desai, Zscaler's Chief Security Officer and EVP of Cyber and AI Engineering, taking a dive deep into Mustang Panda's latest campaign. Zscaler ThreatLabz uncovered new tools used by Mustang Panda, including the backdoors TONEINS, TONESHELL, PUBLOAD, and the proxy tool StarLoader, all delivered via phishing. They also discovered two custom keyloggers, PAKLOG and CorKLOG, and an EDR evasion tool, SplatCloak, highlighting the group's focus on surveillance, persistence, and stealth in cyberespionage operations.4o. The research can be found here: Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1 Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2 Learn more about your ad choices. Visit megaphone.fm/adchoices

This week, we are joined by Deepen Desai, Zscaler's Chief Security Officer and EVP of Cyber and AI Engineering, taking a dive deep into Mustang Panda's latest campaign. Zscaler ThreatLabz uncovered new tools used by Mustang Panda, including the backdoors TONEINS, TONESHELL, PUBLOAD, and the proxy tool StarLoader, all delivered via phishing. They also discovered two custom keyloggers, PAKLOG and CorKLOG, and an EDR evasion tool, SplatCloak, highlighting the group's focus on surveillance, persistence, and stealth in cyberespionage operations.4o. The research can be found here: Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1 Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2 Learn more about your ad choices. Visit megaphone.fm/adchoices

This week in the security news: Malware-laced printer drivers Unicode steganography Rhode Island may sue Deloitte for breach. They may even win. Japan's active cyber defense law Stop with the ping LLMs replace Stack Overflow - ya don't say? Aggravated identity theft is aggravating Ivanti DSM and why you shouldn't use it EDR is still playing cat and mouse with malware There's a cellular modem in your solar gear Don't slack on securing Slack XSS in your mail SIM swapping and the SEC Ivanti and libraries Supercomputers in space! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-875

This episode is sponsored by Edmond de Rothschild and Palistar Capital and first appeared on The Infrastructure Investor Podcast  Digital infrastructure is developing rapidly, turbocharged first by the coronavirus pandemic and now by advances in artificial intelligence, which have turned data centres into arguably the hottest investment in infrastructure at the moment. The sector also includes fibre and towers, both of which are also attracting strong investor interest. This episode focuses on the growth of – and opportunities within – digital infrastructure's three key subsectors. Jean-Francis Dusch, global head of infrastructure and structured finance at EdR, and Josh Oboler, investment partner at Palistar Capital, explore how AI is transforming the data centre landscape, where to find the best opportunities in fibre, and why towers continue to make such a good investment.

This week in the security news: Malware-laced printer drivers Unicode steganography Rhode Island may sue Deloitte for breach. They may even win. Japan's active cyber defense law Stop with the ping LLMs replace Stack Overflow - ya don't say? Aggravated identity theft is aggravating Ivanti DSM and why you shouldn't use it EDR is still playing cat and mouse with malware There's a cellular modem in your solar gear Don't slack on securing Slack XSS in your mail SIM swapping and the SEC Ivanti and libraries Supercomputers in space! Show Notes: https://securityweekly.com/psw-875

This week in the security news: Malware-laced printer drivers Unicode steganography Rhode Island may sue Deloitte for breach. They may even win. Japan's active cyber defense law Stop with the ping LLMs replace Stack Overflow - ya don't say? Aggravated identity theft is aggravating Ivanti DSM and why you shouldn't use it EDR is still playing cat and mouse with malware There's a cellular modem in your solar gear Don't slack on securing Slack XSS in your mail SIM swapping and the SEC Ivanti and libraries Supercomputers in space! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-875

This week in the security news: Malware-laced printer drivers Unicode steganography Rhode Island may sue Deloitte for breach. They may even win. Japan's active cyber defense law Stop with the ping LLMs replace Stack Overflow - ya don't say? Aggravated identity theft is aggravating Ivanti DSM and why you shouldn't use it EDR is still playing cat and mouse with malware There's a cellular modem in your solar gear Don't slack on securing Slack XSS in your mail SIM swapping and the SEC Ivanti and libraries Supercomputers in space! Show Notes: https://securityweekly.com/psw-875

The LockBit ransomware gang has been hacked. Google researchers identify a new infostealer called Lostkeys. SonicWall is urging customers to patch three critical device vulnerabilities. Apple patches a critical remote code execution flaw. Cisco patches 35 vulnerabilities across multiple products. Iranian hackers cloned a German modeling agency's website to spy on Iranian dissidents. Researchers bypass SentinelOne's EDR protection. Education tech firm PowerSchool faces renewed extortion. CrowdStrike leans into AI amidst layoffs. Our guest is Caleb Barlow, CEO of Cyberbit, discussing the mixed messages of the cyber skills gaps. Honoring the legacy of Joseph Nye. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Caleb Barlow, CEO of Cyberbit, who is discussing the mixed messages of the cyber skills gaps. Selected Reading LockBit ransomware gang hacked, victim negotiations exposed (Bleeping Computer) Russian state-linked Coldriver spies add new malware to operation (The Record) Fake AI Tools Push New Noodlophile Stealer Through Facebook Ads (Hackread) SonicWall urges admins to patch VPN flaw exploited in attacks (Bleeping Computer) Researchers Details macOS Remote Code Execution Vulnerability - CVE-2024-44236 (Cyber Security News) Cisco IOS XE Wireless Controllers Vulnerability Enables Full Device Control for Attackers (Cyber Security News) Cisco Patches 35 Vulnerabilities Across Several Products (SecurityWeek) Iranian Hackers Impersonate as Model Agency to Attack Victims (Cyber Security News) Hacker Finds New Technique to Bypass SentinelOne EDR Solution (Infosecurity Magazine) CrowdStrike trims workforce by 5 percent, aims to rely on AI (The Register) Despite ransom payment, PowerSchool hacker now extorting individual school districts (The Record)  Joseph Nye, Harvard professor, developer of “soft power” theory, and an architect of modern international relations, dies at 88 (Harvard University)  Nye Lauded for Cybersecurity Leadership (The Belfer Center for Science and International Affairs at Harvard University) Share your feedback. We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.  Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here's our media kit. Contact us at cyberwire@n2k.com to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Security news for this week: RDP and credentials that are not really revoked, and some RDP bitmap caching fun Some magic info on MagicINFO Vulnerability Management Zombies There is a backdoor in your e-commerce Airborne: vulnerabilities in AirPlay Bring your own installer - crafty EDR bypass The Signal clone used by US government officials: shocker: has been hacked AI slop vulnerability reporting Bricking iPhones with a single line of code Hacking planet technology Vibe hacking for the win? Cybersecurity CEO arrested for deploying malware Hello my perverted friend FastCGI - fast, but vulnerable Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-873

Security news for this week: RDP and credentials that are not really revoked, and some RDP bitmap caching fun Some magic info on MagicINFO Vulnerability Management Zombies There is a backdoor in your e-commerce Airborne: vulnerabilities in AirPlay Bring your own installer - crafty EDR bypass The Signal clone used by US government officials: shocker: has been hacked AI slop vulnerability reporting Bricking iPhones with a single line of code Hacking planet technology Vibe hacking for the win? Cybersecurity CEO arrested for deploying malware Hello my perverted friend FastCGI - fast, but vulnerable Chapters: 0:00 Opening and introductions 2:43 Panel introductions and conference recaps 4:46 Conference announcements and Corncon discussion 8:05 RSAC 2025 recap and vulnerability management trends 15:44 RDP credential revocation flaw in Windows 11 34:57 Apple AirPlay "wormable" vulnerabilities and third-party device risks 44:10 Signal clone breach used by US officials (TeleMessage incident) 55:38 Supply chain attack: Magento extensions backdoor 66:12 "Hello my perverted friend": Sextortion scam analysis 72:10 Security culture and phishing awareness at home 75:25 Digital signage vulnerabilities: Samsung MagicInfo 81:41 Threat hunting tradecraft and blue team operations 88:38 AI slop in vulnerability reporting and vibe hacking 98:59 Apple notification DoS and sandbox bypass 101:24 VMware licensing controversy and alternatives 107:14 CEO arrested for planting malware in hospital systems 116:06 FastCGI vulnerabilities in embedded/IoT systems 122:12 Rooting Android phones and device locking 124:08 Closing and outro Show Notes: https://securityweekly.com/psw-873

Security news for this week: RDP and credentials that are not really revoked, and some RDP bitmap caching fun Some magic info on MagicINFO Vulnerability Management Zombies There is a backdoor in your e-commerce Airborne: vulnerabilities in AirPlay Bring your own installer - crafty EDR bypass The Signal clone used by US government officials: shocker: has been hacked AI slop vulnerability reporting Bricking iPhones with a single line of code Hacking planet technology Vibe hacking for the win? Cybersecurity CEO arrested for deploying malware Hello my perverted friend FastCGI - fast, but vulnerable Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-873

In the leadership and communications section, The C-suite gap that's putting your company at risk, CISOs band together to urge world governments to harmonize cyber rules, Cybersecurity is Not Working: Time to Try Something Else, and more! Organizations are increasingly threatened by cyberattacks originating from their suppliers. Existing tools (like EDR, MDR, and XDR) effectively handle threats within an organization, but leave a gap regarding third-party risk. SecurityScorecard created the Supply Chain Detection and Response category to empower organizations to shift from being reactive and uncertain to confidently and proactively protecting their entire supply chain. What is Supply Chain Detection and Response (SCDR)?: https://securityscorecard.com/blog/what-is-supply-chain-detection-and-response/ Learn more about continuous supply chain cyber risk detection and response: https://securityscorecard.com/why-securityscorecard/supply-chain-detection-response/ Claim Your Free SCDR Assessment: https://securityscorecard.com/get-started-scdr/#form This segment is sponsored by Security Scorecard. Visit https://securityweekly.com/securityscorecardrsac for more information on how SecurityScorecard MAX and Supply Chain Detection and Response can help your organization identify and resolve supply chain risks. In this interview, Axonius CISO Lenny Zeltser shares the vision behind Axonius Exposures, the company's latest innovation in unified risk management. Launched ahead of RSA Conference 2025, Exposures tackles one of the most persistent challenges in cybersecurity today: making sense of fragmented risk signals to drive confident, actionable decision-making. Lenny will discuss how Exposures unifies security findings, asset intelligence, and business context in a single platform — giving security teams the clarity and automation they need to prioritize what truly matters. He'll also explore what this launch means for Axonius' mission, the evolution of cyber asset management, and how organizations can move from reactive security postures to proactive, risk-based strategies. Want to see how Axonius Exposures gives you the clarity to take action on your most critical risks? Visit https://securityweekly.com/axoniusrsac to learn more and schedule a personalized demo. Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://securityweekly.com/bsw-394

In the leadership and communications section, The C-suite gap that's putting your company at risk, CISOs band together to urge world governments to harmonize cyber rules, Cybersecurity is Not Working: Time to Try Something Else, and more! Organizations are increasingly threatened by cyberattacks originating from their suppliers. Existing tools (like EDR, MDR, and XDR) effectively handle threats within an organization, but leave a gap regarding third-party risk. SecurityScorecard created the Supply Chain Detection and Response category to empower organizations to shift from being reactive and uncertain to confidently and proactively protecting their entire supply chain. What is Supply Chain Detection and Response (SCDR)?: https://securityscorecard.com/blog/what-is-supply-chain-detection-and-response/ Learn more about continuous supply chain cyber risk detection and response: https://securityscorecard.com/why-securityscorecard/supply-chain-detection-response/ Claim Your Free SCDR Assessment: https://securityscorecard.com/get-started-scdr/#form This segment is sponsored by Security Scorecard. Visit https://securityweekly.com/securityscorecardrsac for more information on how SecurityScorecard MAX and Supply Chain Detection and Response can help your organization identify and resolve supply chain risks. In this interview, Axonius CISO Lenny Zeltser shares the vision behind Axonius Exposures, the company's latest innovation in unified risk management. Launched ahead of RSA Conference 2025, Exposures tackles one of the most persistent challenges in cybersecurity today: making sense of fragmented risk signals to drive confident, actionable decision-making. Lenny will discuss how Exposures unifies security findings, asset intelligence, and business context in a single platform — giving security teams the clarity and automation they need to prioritize what truly matters. He'll also explore what this launch means for Axonius' mission, the evolution of cyber asset management, and how organizations can move from reactive security postures to proactive, risk-based strategies. Want to see how Axonius Exposures gives you the clarity to take action on your most critical risks? Visit https://securityweekly.com/axoniusrsac to learn more and schedule a personalized demo. Show Notes: https://securityweekly.com/bsw-394

In the leadership and communications section, The C-suite gap that's putting your company at risk, CISOs band together to urge world governments to harmonize cyber rules, Cybersecurity is Not Working: Time to Try Something Else, and more! Organizations are increasingly threatened by cyberattacks originating from their suppliers. Existing tools (like EDR, MDR, and XDR) effectively handle threats within an organization, but leave a gap regarding third-party risk. SecurityScorecard created the Supply Chain Detection and Response category to empower organizations to shift from being reactive and uncertain to confidently and proactively protecting their entire supply chain. What is Supply Chain Detection and Response (SCDR)?: https://securityscorecard.com/blog/what-is-supply-chain-detection-and-response/ Learn more about continuous supply chain cyber risk detection and response: https://securityscorecard.com/why-securityscorecard/supply-chain-detection-response/ Claim Your Free SCDR Assessment: https://securityscorecard.com/get-started-scdr/#form This segment is sponsored by Security Scorecard. Visit https://securityweekly.com/securityscorecardrsac for more information on how SecurityScorecard MAX and Supply Chain Detection and Response can help your organization identify and resolve supply chain risks. In this interview, Axonius CISO Lenny Zeltser shares the vision behind Axonius Exposures, the company's latest innovation in unified risk management. Launched ahead of RSA Conference 2025, Exposures tackles one of the most persistent challenges in cybersecurity today: making sense of fragmented risk signals to drive confident, actionable decision-making. Lenny will discuss how Exposures unifies security findings, asset intelligence, and business context in a single platform — giving security teams the clarity and automation they need to prioritize what truly matters. He'll also explore what this launch means for Axonius' mission, the evolution of cyber asset management, and how organizations can move from reactive security postures to proactive, risk-based strategies. Want to see how Axonius Exposures gives you the clarity to take action on your most critical risks? Visit https://securityweekly.com/axoniusrsac to learn more and schedule a personalized demo. Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://securityweekly.com/bsw-394

At RSAC Conference 2025, Sean Martin catches up with Brian Dye, CEO of Corelight, to explore a recurring truth in cybersecurity: attackers adapt, and defenders must follow suit. In this episode, Dye lays out why traditional perimeter defenses and endpoint controls alone are no longer sufficient—and why it's time for security teams to look back toward the network for answers.Beyond the Perimeter: Visibility as a Force MultiplierAccording to Dye, many organizations are still relying on security architectures that were top-of-the-line a decade ago. But attackers have already moved on. They're bypassing endpoint detection and response (EDR) tools, exploiting unmanaged devices, IoT, and edge vulnerabilities. What's left exposed is the network itself—and that's where Corelight positions itself: providing what Dye calls “ground truth” through network-based visibility.Rather than rearchitecting environments or pushing intrusive solutions, Corelight integrates passively through out-of-line methods like packet brokers or traffic mirroring. The goal? Rich, contextual, retrospective visibility—without disrupting the network. This capability has proven essential for responding to advanced threats, including lateral movement and ransomware campaigns where knowing exactly what happened and when can mean the difference between paying a ransom or proving there's no real damage.Three Layers of Network InsightDye outlines a layered approach to detection:1. Baseline Network Activity – High-fidelity summaries of what's happening.2. Raw Detections – Behavioral rules, signatures, and machine learning.3. Anomaly Detection – Identifying “new and unusual” activity with clustering math that filters out noise and highlights what truly matters.This model supports teams who need to correlate signals across endpoints, identities, and cloud environments—especially as AI-driven operations expand the attack surface with non-human behavior patterns.The Metrics That MatterDye points to three critical success metrics for teams:• Visibility coverage over time.• MITRE ATT&CK coverage, especially around lateral movement.• The percentage of unresolved cases—those embarrassing unknowns that drain time and confidence.As Dye shares, organizations that prioritize network-level visibility not only reduce uncertainty, but also strengthen every other layer of their detection and response strategy.Learn more about Corelight: https://itspm.ag/coreligh-954270Note: This story contains promotional content. Learn more.Guest: Brian Dye, Chief Executive Officer, Corelight | https://www.linkedin.com/in/brdye/ResourcesLearn more and catch more stories from Corelight: https://www.itspmagazine.com/directory/corelightLearn more and catch more stories from RSA Conference 2025 coverage: https://www.itspmagazine.com/rsac25______________________Keywords:sean martin, brian dye, network, visibility, ransomware, detection, cybersecurity, soc, anomalies, baselining, brand story, brand marketing, marketing podcast, brand story podcast______________________Catch all of our event coverage: https://www.itspmagazine.com/technology-and-cybersecurity-conference-coverageWant to tell your Brand Story Briefing as part of our event coverage? Learn More 

Send us a text In this episode, Joe sits down with John Carse, Field CISO at SquareX, to dive into the often-overlooked world of browser security and the evolving landscape of cybersecurity. Recorded despite a 12-hour time difference (Singapore to the US!), John shares:The Browser Security Gap: Why 85% of user time in browsers is a growing risk for SaaS and cloud environments .SquareX's Solution: How SquareX acts as an EDR for browsers, detecting and responding to threats like polymorphic extensions .Career Journey: From early IT days to field CISO, John reveals how foundational IT skills (help desk, field services) make better cyber professionals .Real-World Insights: Lessons from working with the US Navy and the importance of understanding IT systems for effective cybersecurity . Check Your Browser Security: Visit SquareX Browser Security to assess your controls. Learn More About SquareX: Explore their solution at sqrx.com. Connect with John: Find him on X @JohnCarseChapters00:00 Introduction and Time Zone Challenges02:54 John Carse's Journey into IT06:05 Transitioning to Cybersecurity08:46 The Importance of Customer Service in IT11:36 Formative Experiences in Help Desk and Field Services14:35 Understanding IT Systems for Cybersecurity23:51 The Interplay Between IT Skills and Cybersecurity24:41 The Role of Security Engineers in IT28:43 Understanding the Complexity of Cybersecurity29:33 Exploring the Field CISO Role32:55 The Browser as a Security Frontier42:07 Challenges in SaaS Security46:20 The Importance of Browser Security AwarenessSubscribe for more cybersecurity insights and career tips! Share your thoughts in the comments—how are you securing your browser? Digital Disruption with Geoff Nielson Discover how technology is reshaping our lives and livelihoods.Listen on: Apple Podcasts SpotifySupport the showFollow the Podcast on Social Media! Tesla Referral Code: https://ts.la/joseph675128 YouTube: https://www.youtube.com/@securityunfilteredpodcast Instagram: https://www.instagram.com/secunfpodcast/Twitter: https://twitter.com/SecUnfPodcast

We've been in enough conversations to know when something clicks. This one did — and it did from the very first moment.In our debut Brand Story with White Knight Labs, we sat down with co-founders John Stigerwalt and Greg Hatcher, and what unfolded was more than a company intro — it was a behind-the-scenes look at what offensive security should be.John's journey is the kind that earns your respect quickly: he started at the help desk and worked his way to CISO, before pivoting into red teaming and co-founding WKL. Greg's path was more unconventional — from orchestral musician to Green Beret to cybersecurity leader. Two very different stories, but a shared philosophy: learn by doing, adapt without a manual, and never take the easy route when something meaningful is on the table.That mindset now defines how White Knight Labs works with clients. They don't sell cookie-cutter pen tests. Instead, they ask the right question up front: How does your business make money? Because if you can answer that, you can identify what a real-world attacker would go after. Then they simulate it — not in theory, but in practice.Their ransomware simulation service is a perfect example. They don't just show up with a scanner. They emulate modern adversaries using Cobalt Strike, bypassing endpoint defenses with in-house payloads, encrypting and exfiltrating data like it's just another Tuesday. Most clients fail the test — not because they're careless, but because most simulations aren't this real.And that's the point.White Knight Labs isn't here to help companies check a box. They're here to expose the gaps and raise the bar — because real threats don't play fair, and security shouldn't pretend they do.What makes them different is what they don't do. They're not an all-in-one shop, and they're proud of that. They won't touch IR for major breaches — they've got partners for that. They only resell hardware and software they've personally vetted. That honesty builds credibility. That kind of focus builds trust.Their training programs are just as intense. Between live DEF CON courses and their online platform, they're giving both new and experienced professionals a chance to train the way they operate: no shortcuts, no watered-down certs, just hard-earned skills that translate into real-world readiness.Pass their ODPC certification, and you'll probably get a call — not because they need to check a hiring box, but because it proves you're serious. And if you can write loaders that bypass real defenses? You're speaking their language.This first conversation with John and Greg reminded us why we started this series in the first place. It's not just about product features or service offerings — it's about people who live and breathe what they do, and who bring that passion into every test, every client call, and every training they offer.We've got more stories with them on the way. But if this first one is any sign of what's to come, we're in for something special.⸻Learn more about White Knight Labs: Guests:John Stigerwalt | Founder at White Knight Labs | Red Team Operations Leader | https://www.linkedin.com/in/john-stigerwalt-90a9b4110/Greg Hatcher | Founder at White Knight Labs | SOF veteran | Red Team | https://www.linkedin.com/in/gregoryhatcher2/White Knight Labs Website | https://itspm.ag/white-knight-labs-vukr______________________Keywords: penetration testing, red team, ransomware simulation, offensive security, EDR bypass, cybersecurity training, White Knight Labs, advanced persistent threat, cybersecurity startup, DEF CON training, security partnerships, cybersecurity services______________________ResourcesVisit the White Knight Labs Website to learn more: https://itspm.ag/white-knight-labs-vukrLearn more and catch more stories from White Knight Labs on ITSPmagazine: https://www.itspmagazine.com/directory/white-knight-labsLearn more about ITSPmagazine Brand Story Podcasts: https://www.itspmagazine.com/purchase-programsNewsletter Archive: https://www.linkedin.com/newsletters/tune-into-the-latest-podcasts-7109347022809309184/Business Newsletter Signup: https://www.itspmagazine.com/itspmagazine-business-updates-sign-upAre you interested in telling your story?https://www.itspmagazine.com/telling-your-story

LevelBlue's latest Threat Trends Report pulls no punches: phishing, malware, and ransomware attacks are not just continuing—they're accelerating. In this episode of ITSPmagazine's Brand Story podcast, hosts Sean Martin and Marco Ciappelli are joined by Kenneth Ng, a threat hunter and lead incident responder on LevelBlue's Managed Detection and Response (MDR) team, to unpack the findings and recommendations from the report.Phishing as a Service and the Surge in Email CompromisesOne of the most alarming trends highlighted by Kenneth is the widespread availability of Phishing-as-a-Service (PhaaS) kits, including names like RaccoonO365, Mamba 2FA, and Greatness. These kits allow attackers with little to no technical skill to launch sophisticated campaigns that bypass multi-factor authentication (MFA) by hijacking session tokens. With phishing attacks now leading to full enterprise compromises, often through seemingly innocuous Microsoft 365 access, the threat is more serious than ever.Malware Is Smarter, Simpler—and It's Spreading FastMalware, particularly fake browser updates and credential stealers like Lumma Stealer, is also seeing a rise in usage. Kenneth points out the troubling trend of malware campaigns that rely on basic user interactions—like copying and pasting text—leading to full compromise through PowerShell or command prompt access. Basic group policy configurations (like blocking script execution for non-admin users) are still underutilized defenses.Ransomware: Faster and More Automated Than EverThe speed of ransomware attacks has increased dramatically. Kenneth shares real-world examples where attackers go from initial access to full domain control in under an hour—sometimes in as little as ten minutes—thanks to automation, remote access tools, and credential harvesting. This rapid escalation leaves defenders with very little room to respond unless robust detection and prevention measures are in place ahead of time.Why This Report MattersRather than presenting raw data, LevelBlue focuses on actionable insights. Each major finding comes with recommendations that can be implemented regardless of company size or maturity level. The report is a resource not just for LevelBlue customers, but for any organization looking to strengthen its defenses.Be sure to check out the full conversation and grab the first edition of the Threat Trends Report ahead of LevelBlue's next release this August—and stay tuned for their updated Futures Report launching at RSA Conference on April 28.Learn more about LevelBlue: https://itspm.ag/levelblue266f6cNote: This story contains promotional content. Learn more.Guest: Kenneth Ng, threat hunter and lead incident responder on LevelBlue's Managed Detection and Response (MDR) team | On LinkedIn: https://www.linkedin.com/in/ngkencyber/ResourcesDownload the LevelBlue Threat Trends Report | Edition One: https://itspm.ag/levelbyqdpLearn more and catch more stories from LevelBlue: https://www.itspmagazine.com/directory/levelblueLearn more about ITSPmagazine Brand Story Podcasts: https://www.itspmagazine.com/purchase-programsNewsletter Archive: https://www.linkedin.com/newsletters/tune-into-the-latest-podcasts-7109347022809309184/Business Newsletter Signup: https://www.itspmagazine.com/itspmagazine-business-updates-sign-upAre you interested in telling your story?https://www.itspmagazine.com/telling-your-story

In this edition of Snake Oilers three vendors pitch host Patrick Gray on their tech: Pangea: Guardrails and security for AI agents and applications (https://pangea.cloud) Worried about your AI apps going rogue, being mean to your customers or even disclosing sensitive information? Pangea exists to address these risks. Fascinating stuff. Cosive: A threat intelligence company that can host your MISP server in AWS. CloudMISP! (https://www.cosive.com/snakeoilers) Are you running a MISP server on some old hardware under a desk in your SOC? There's a better way! Cosive can run it for you on AWS so you can just use it instead of wrestling with maintaining it. They also do some CTI consulting to help you get better use out of MISP. Sysdig: A Linux runtime security platform (https://sysdig.com/) The modern Windows network is an all-singing, all-dancing, perfectly orchestrated, EDR-protected ballet. The modern Linux production environment… isn't. Find out how Sysdig can help you get some visibility and control over your Linux fleet. This episode is also available on Youtube. Show notes

In the security news this week: You should really just patch things, the NVD backlog, Android phones with malware pre-installed, so convenient, keyloggers and a creepy pharmacist, snooping on federal workers, someone stole your browser history, NSA director fired, deputy director of NSA also fired, CrushFTP the saga continues, only steal the valid credit cards, another post that vanished from the Internet, hiding in NVRAM, protecting the Linux kernel, you down with MCP?, more EOL IoT, bypassing kernel protections, when are you ready for a pen test, red team and bug bounty, what EDR is really missing, and based on this story you should just patch everything all the time! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-869

In this episode of the cybersecurity month-end review, host Jim Love is joined by Daina Proctor from IBM in Ottawa, Randy Rose from The Center for Internet Security from Saratoga Springs, and David Shipley, CEO of Beauceron Security from Fredericton. The panel discusses major cybersecurity stories from the past month, including the Oracle Cloud breach and its communication failures, the misuse of Signal by U.S. government officials, and global cybersecurity regulation efforts such as the UK's new critical infrastructure laws. They also cover notable incidents like the Kuala Lumpur International Airport ransomware attack and the NHS Scotland cyberattack, the continuous challenges of EDR bypasses, and the importance of fusing anti-fraud and cybersecurity efforts. The discussion emphasizes the need for effective communication and stringent security protocols amidst increasing cyber threats. 00:00 Introduction and Panelist Introductions 01:25 Oracle Cloud Breach: A Case Study in Incident Communication 10:13 Signal Group Chat Controversy 20:16 Leadership and Cybersecurity Legislation 23:30 Cybersecurity Certification Program Overview 24:27 Challenges in Cybersecurity Leadership 24:59 Importance of Data Centers and MSPs 26:53 UK Cybersecurity Bill and MSP Standards 28:09 Cyber Essentials and CMMC Standards 32:47 EDR Bypasses and Small Business Security 39:32 Ransomware Attacks on Critical Infrastructure 43:34 Law Enforcement and Cybercrime 47:24 Conclusion and Final Thoughts

A successful SIEM deployment depends on a lot more than implementing the SIEM correctly. So many other things in your environment have an impact on your chances of a successful SIEM. Are the right logs enabled? Is your EDR working correctly? Would you notice a sudden increase or decrease in events from critical sources? What can practitioners do to ensure the success of their SIEM deployment? This segment is sponsored by Graylog. Visit https://securityweekly.com/graylog to learn more about them! In this interview, we feature some research from Geoff Cairns, an analyst at Forrester Research. This is a preview to the talk he'll be giving at Identiverse 2025 in a few months. We won't have time to cover all the trends, but there are several here that I'm excited to discuss! Deepfake Detection Difficult Zero Trust Agentic AI Phishing resistant MFA adoption Identity Verification Machine Identity Decentralized Identity Post Quantum Shared Signals Segment Resources: The Top Trends Shaping Identity And Access Management In 2025 - (Forrester subscription required) In this week's enterprise security news, Big funding for Island Is DLP finally getting disrupted? By something that works? We learn all about Model Context Protocol servers Integrating SSO and SSH! Do we have too many cybersecurity regulations? Toxic cybersecurity workplaces Napster makes a comeback this week, we've got 50% less AI and 50% more co-hosts All that and more, on this episode of Enterprise Security Weekly. Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw-400