Podcasts about PKI

We build on our Trust Models discussion to explore how organizations can structure their PKI for the transition to post quantum cryptography (PQC).

In this episode, we break down Parkland’s $9.1B proposed acquisition by Sunoco and why the timing is controversial. We also cover earnings from Loblaws, TMX Group, McDonald’s, Riocan, and Spin Master. From strong retail leasing spreads to e-commerce growth and tariff headwinds, we dig into how each company is navigating the current economic environment—and what investors should watch going forward. Tickers of stocks discussed: X.TO, MCD, L.TO, REI-UN.TO, TOY, PKI.TO Check out our portfolio by going to Jointci.com Our Website Canadian Investor Podcast Network Twitter: @cdn_investing Simon’s twitter: @Fiat_Iceberg Braden’s twitter: @BradoCapital Dan’s Twitter: @stocktrades_ca Want to learn more about Real Estate Investing? Check out the Canadian Real Estate Investor Podcast! Apple Podcast - The Canadian Real Estate Investor Spotify - The Canadian Real Estate Investor Web player - The Canadian Real Estate Investor Asset Allocation ETFs | BMO Global Asset Management Sign up for Finchat.io for free to get easy access to global stock coverage and powerful AI investing tools. Register for EQ Bank, the seamless digital banking experience with better rates and no nonsense.See omnystudio.com/listener for privacy information.

On todays episode Danny is joined by David Mahdi, Chief Identity Officer (CIO) for Transmit Security. David is a globally recognized leader in cybersecurity and digital identity, renowned for his pioneering work in establishing digital trust across complex enterprise ecosystems. With over two decades of experience, he has been instrumental in shaping the fields of identity-first security, cryptography, and machine identity management. As the CIO at Transmit Security and former Chief Strategy Officer and CISO Advisor at Sectigo, David has guided organizations through digital transformation initiatives, including the development of cryptography centers of excellence and the implementation of passwordless authentication systems. His tenure as a top-performing VP Analyst at Gartner solidified his reputation as a trusted advisor to Fortune 500 companies, where he provided insights on cybersecurity, blockchain, PKI, and IoT security. David's thought leadership extends to his contributions to the Forbes Technology Council and the Fast Company Executive Board, where he continues to influence the discourse on digital trust and cybersecurity. His holistic approach, encompassing IT, engineering, business development, and marketing, positions him uniquely to address the multifaceted challenges of today's digital landscape. In this podcast, David shares his insights on the evolving landscape of digital identity, the importance of establishing digital trust, and the future of cybersecurity in an increasingly interconnected world:The most surprising challenge David has faced in leading innovation at scaleSomething David struggles with as a leader in the tech spaceHow to maintain peak performance and keep your team motivatedThe role AI plays in the evolution of digital identity and fraud preventionHow to manage energy and focusWhat excites David most about the future of digital security and identity managementAnd more...Are you getting every episode of Digital Transformation & Leadership in your favourite podcast player? You can find us Apple Podcasts and Spotify to subscribe.

Passwort-Podcast ohne PKI: unvorstellbar! Daher sprechen Sylvester und Christopher in der aktuellen FOlge auch über Kritik an der automatischen Zertifikatsvergabe per ACME-Protokoll. Außerdem staunen sie ob eines Milliardendiebstahls bei der Kryptobörse Bybit, ärgern sich über verschiedene staatliche Versuche, Verschlüsselung zu schwächen und ermutigen ihre Hörer, bei der Auswahl der Testdomain umsichtig vorzugehen. - https://blog.thc.org/practical-https-interception - CertSpotter: https://github.com/SSLMate/certspotter - https://tuta.com/de/blog/france-surveillance-nacrotrafic-law - https://support.apple.com/en-us/122234 - https://www.cl.cam.ac.uk/~ah793/papers/2025police.pdf - https://www.bloomberg.com/opinion/articles/2025-03-03/citi-keeps-hitting-the-wrong-buttons - https://www.heise.de/news/BAMF-Skurrile-Testkonten-ermoeglichten-unautorisierten-Datenzugriff-10305691.html - https://github.com/jlopp/physical-bitcoin-attacks Mitglieder unserer Security Community auf heise security PRO hören alle Folgen bereits zwei Tage früher. Mehr Infos: https://pro.heise.de/passwort

In this episode, Job Snijders discusses RPKIViews, his long term project to collect the "views" of RPKI state every day, and maintain an archive of BGP route validation states. The project is named to reflect route views, the long-standing archive of BGP state maintained by the University of Oregon, which has been discussed on PING. Job is based in the Netherlands, and has worked in BGP routing for large international ISPs and content distribution networks as well as being a board member of the RIPE NCC. He is known for his work producing the Open-Source rpki-client RPKI Validator, implemented in C and distributed widely through the OpenBSD project. RPKI is the Resource PKI, Resource meaning the Internet Number Resources, the IPv4, IPv6 and Autonomous System (AS) numbers which are used to implement routing in the global internet. The PKI provides cryptographic proofs of delegation of these resources and allows the delegates to sign over their intentions originating specific prefixes in BGP, and the relationships between the AS which speak BGP to each other. Why rpkiviews? Job explains that there's a necessary conversation between people involved in the operational deployment of secure BGP, and the standards development and research community: How many of the worlds BGP routes are being protected? How many places are producing Route Origin Attestations (ROA) which are the primary cryptographic object used to perform Route Origin Validation (ROV) and how many objects are made? Whats the error rate in production, the rate of growth, a myriad of introspective "meta" questions need to be asked in deploying this kind of system at scale, and one of the best tools to use, is an archive of state, updated frequently, and as for route views collected from a diverse range of places worldwide, to understand the dynamics of the system. Job is using the archive to produce his annual "RPKI Year in review" report, which was published this year on the APNIC blog (it's posted to operations, research and standards development mailing lists and presented at conferences and meetings normally) and products are being used by the BGPAlerter service developed by Massimo Candela

Selamat hari lahir ke-100 tahun Bung Pram. Hari ini, tepat 100 tahun yang lalu, Pram kecil lahir di tanggal 6 Februari 1925 di sebuah kota kecil penuh sejarah, Blora. Karya-karya Pram seringkali dikaitkan dengan perlawanan, pergerakan rakyat kecil, dan potret sejarah feodalisme yang terjadi di Bumi manusia. Seolah diamini oleh rakyat Indonesia, karya-karyanya selain membawanya kepada popularitas, juga membawanya ke sudut-sudut penjara dan pengasingan ke tanah-tanah terpencil di Indonesia. Sebut lah pulau Buru, salah satu pulau di kepulauan Maluku. Dia ditangkap dan diasingkan ke pulau Buru pada era Orde Baru karena dianggap sebagai simpatisan dari PKI. Dia dijauhkan dari segala bentuk alat tulis, namun, alih-alih dia menyerah terhadap sastra, pengasingan tersebut justru malah melahirkan salah satu karya terbaiknya, Tetralogi Pulau Buru (Bumi Manusia, Anak Semua Bangsa, Jejak Langkah, dan Rumah Kaca). #SeabadPram #PramoedyaAnantaToer #BumiManusia #Maripadabaca

I'm always asked the same question when talking to customers about the threats of quantum computing and the move to post-quantum cryptography. What are similar companies doing about it? It's only been half a year since the NIST standards were published, but we're starting to see some traction. Join host Konstantinos Karagiannis for a chat with Samantha Mabey from Entrust about an interesting study on migration, along with some tactical advice for getting your PQC journey underway. For more information on Entrust, visit www.entrust.com/.  Read the PKI and PQ study here:  www.entrust.com/cybersecurity-institute/reports/2024-pki-and-post-quantum-trends-study.  Visit Protiviti at www.protiviti.com/US-en/technology-consulting/quantum-computing-services  to learn more about how Protiviti is helping organizations get post-quantum ready.  Follow host Konstantinos Karagiannis on all socials: @KonstantHacker and follow Protiviti Technology on LinkedIn and Twitter: @ProtivitiTech.     Questions and comments are welcome!  Theme song by David Schwartz, copyright 2021.  The views expressed by the participants of this program are their own and do not represent the views of, nor are they endorsed by, Protiviti Inc., The Post-Quantum World, or their respective officers, directors, employees, agents, representatives, shareholders, or subsidiaries.  None of the content should be considered investment advice, as an offer or solicitation of an offer to buy or sell, or as an endorsement of any company, security, fund, or other securities or non-securities offering. Thanks for listening to this podcast. Protiviti Inc. is an equal opportunity employer, including minorities, females, people with disabilities, and veterans.

Christopher und Sylvester kämpfen sich mal wieder durch einige Ankündigungen für Zertifikate und Vorfälle mit denselben. Außerdem werfen sie einen Blick auf eine Malwaregruppe, die auf andere Cyberkriminelle und Sicherheitsforscher abzielt, und besprechen, warum diese Gruppen oft so viele komische Namen haben. Zuletzt geht es noch um neue Tricks, wie Nutzer über ihre Browserengine nachverfolgt werden können – und wie man sich dagegen wehrt. * [Let's Encrypt-Ankündigung](https://letsencrypt.org/2024/12/11/eoy-letter-2024/) * [Bericht zu MUT-1244](https://securitylabs.datadoghq.com/articles/mut-1244-targeting-offensive-actors/) * [Threat-Actor-Naming-RFC](https://www.misp-standard.org/rfc/threat-actor-naming.html) * [CSS-Fingerprinting](https://doi.org/10.60882/cispa.27194472.v3) * [c't-Mailclient-Übersicht](https://heise.de/-10241634) Mitglieder unserer Security Community auf heise security PRO hören alle Folgen bereits zwei Tage früher. Mehr Infos: https://pro.heise.de/passwort

The old adage states that a monkey in front of a keyboard, given enough time, could randomly type the works of Shakespeare. Apparently, someone ran the numbers and said not so much. We break it down and explain why we're discussing this on a PKI podcast.

Can you pen test yourself? Paula Januszkiewicz says yes! Richard talks to Paula about taking an active role in understanding your organization's security vulnerabilities. Paula talks about the low-hanging fruit she often finds as a professional penetration tester - typically on poorly maintained infrastructure like PKI servers. The conversation digs into tooling you can use to find vulnerabilities - just make sure you trust the source of those tools. Not everyone is a good guy in open source! And, of course, there's always a time to bring in professionals to do a deeper level of testing. Don't wait until the breach happens to take some action!LinksCqurePenetration TestingGitHub Secrets ScanningHaveIBeenPwnedRecorded August 22, 2024

As most EV enthusiasts know, the Tesla-developed North American Charging System (NACS) is being standardized as SAE J3400 — unlocking the ability for any EV supplier or manufacturer to use, manufacture, or deploy the J3400 connector on EVs and at charging stations across North America. . Recently, the SAE J3400 NACS Task Force voted to establish the J3400 standard as a recommended practice, marking a significant step forward in the standardization process and demonstrating the importance of collaboration in moving the EV industry forward. . To learn more, we sat down with Christian Thiele, Director, Global Ground Vehicle Standards, SAE International, and Dr. Rodney McGee, Ph.D., P.E., Chairman, SAE J3400 NACS Task Force, and Chief Engineer at the University of Delaware, to discuss how the J3400 standard is bringing industry together to build a unified and reliable EV infrastructure that supports the widespread adoption of EVs. . Join the global EV ecosystem leader! The SAE EV Charging PKI Project designed and tested an inclusive, protocol-neutral, worldwide EV charging industry PKI platform that is secure, trusted, scalable, interoperable, and extensible. View and download the program overview now. . We'd love to hear from you. Share your comments, questions and ideas for future topics and guests to podcast@sae.org. Don't forget to take a moment to follow SAE Tomorrow Today—a podcast where we discuss emerging technology and trends in mobility with the leaders, innovators and strategists making it all happen—and give us a review on your preferred podcasting platform. . Follow SAE on LinkedIn, Instagram, Facebook, Twitter, and YouTube. Follow host Grayson Brulte on LinkedIn, Twitter, and Instagram.

Enjoy this special encore episode where we are joined by, Microsoft's Corporate Vice President of Cybersecurity Business Development Ann Johnson brings us on her career journey from aspiring lawyer to cybersecurity executive. After pivoting from studying law, Ann started working with computers and found she had a deep technical aptitude for technology and started earning certifications landing in cybersecurity because she found an interest in PKI. At Microsoft, Ann says she solves some of the hardest problems every day. She recommends getting a mentor and finding your area of expertise. She leaves us with three dimensions she hopes to be her legacy: 1. diversity in more than just gender, 2. bringing a human aspect to the industry, and 3. being empathetic to the user experience. We thank Ann for sharing her story with us. Learn more about your ad choices. Visit megaphone.fm/adchoices

Enjoy this special encore episode where we are joined by, Microsoft's Corporate Vice President of Cybersecurity Business Development Ann Johnson brings us on her career journey from aspiring lawyer to cybersecurity executive. After pivoting from studying law, Ann started working with computers and found she had a deep technical aptitude for technology and started earning certifications landing in cybersecurity because she found an interest in PKI. At Microsoft, Ann says she solves some of the hardest problems every day. She recommends getting a mentor and finding your area of expertise. She leaves us with three dimensions she hopes to be her legacy: 1. diversity in more than just gender, 2. bringing a human aspect to the industry, and 3. being empathetic to the user experience. We thank Ann for sharing her story with us. Learn more about your ad choices. Visit megaphone.fm/adchoices

The migration to post-quantum cryptography (PQC) is about to begin and is necessary to protect against the threats of fault-tolerant quantum computing. However, critical assets like those in military, banking and government environments also require other layers of security and strategies, such as zero trust and increased encryption bit sizes. Join host Konstantinos Karagiannis as he discusses with his guest, Richard Blech from XSOC, a high-performance symmetric encryption solution that will provide defense in-depth today and after thousands of logical qubits arrive.  For more on XSOC, visit www.xsoccorp.com/ .  Visit Protiviti at www.protiviti.com/US-en/technology-consulting/quantum-computing-services  to learn more about how Protiviti is helping organizations get post-quantum ready.  Follow host Konstantinos Karagiannis on all socials: @KonstantHacker and follow Protiviti Technology on LinkedIn and Twitter: @ProtivitiTech.  Questions and comments are welcome!   Theme song by David Schwartz, copyright 2021.   The views expressed by the participants of this program are their own and do not represent the views of, nor are they endorsed by, Protiviti Inc., The Post-Quantum World, or their respective officers, directors, employees, agents, representatives, shareholders, or subsidiaries.  None of the content should be considered investment advice, as an offer or solicitation of an offer to buy or sell, or as an endorsement of any company, security, fund, or other securities or non-securities offering. Thanks for listening to this podcast. Protiviti Inc. is an equal opportunity employer, including minorities, females, people with disabilities, and veterans.

When we discuss certificate discovery in CLM platforms, there is a common assumption that we're talking about public certificates exclusively. In this episode we explain the value of certificate discovery for internal PKI certificates also.

Do you want to gain a deeper understanding of how PKI, AI, and cryptography are shaping software development? Our special guest is Loren KohnfelderLoren Kohnfelder's journey into the world of AI and cybersecurity began with an early exposure to mainframe programming at the age of twelve. His fascination with software development grew from experimenting with basic assembly language, COBOL, Basic, Fortran, and RPG. Over the years, he witnessed the evolution of programming languages and the crucial shift towards memory safety. As he delved deeper into the world of AI, Loren's perspective on the application of AI in cybersecurity evolved, emphasizing the importance of trust and clear policies. His insightful narrative highlights the significance of automation and the need for transparency within the security industry, offering a unique and relatable perspective on the ever-changing landscape of software development and cybersecurity.Discover how artificial intelligence is revolutionizing the cybersecurity landscape and its impact on software development.Understand the critical role of trust in AI cybersecurity and how it influences decision-making in software development.Learn about the triaging approach to automating cybersecurity and its significance for software developers and IT professionals.Explore effective methods for monitoring and evaluating the performance of AI in cybersecurity to enhance software development practices.Gain insights into the importance of transparency and knowledge sharing in cybersecurity for informed decision-making in software development.I believe in challenging all this stuff because I think we have plenty of room for improvement and we need to keep going at it. We can't give up and resign ourselves to business as usual. We have to keep pushing it and asking, why is that? Why can't we do it this way? Why isn't it better? Keep trying. - Loren KohnfelderIn this episode, you will be able to:Discover how artificial intelligence is revolutionizing cybersecurity and what it means for the future of software development.Explore the triaging approach to automating cybersecurity and its potential to streamline threat detection and response.Uncover the significance of transparency and knowledge sharing in cybersecurity for fostering a more secure digital environment.Connect with Loren KohnfelderLinkedIn: https://www.linkedin.com/in/kohnfelder/Designing Secure Software Book: https://a.co/d/07h5nQnaConnect with usWebsite: securitymasterminds.buzzsprout.comKnowBe4 Resources:KnowBe4 Blog: https://blog.knowbe4.comJames McQuiggan - https://www.linkedin.com/in/jmcquigganErich Kron: https://www.linkedin.com/in/erichkron/Music Composed by: Brian Sanyshyn - https://www.briansanyshynmusic.comAnnouncer: Sarah McQuiggan - https://www.sarahmcquiggan.comShow Notes created with Capsho - www.capsho.comSound Engineering - Matthew Bliss, MB Podcasts.If you'd like to ask Matt what he can do for your podcast, visit https://www.mbpod.com and schedule a consultation today! 

Welcome to episode 265 of the Cloud Pod Podcast – where the forecast is always cloudy! Justin and Matthew are with you this week, and even though it's a light news week, you're definitely going to want to stick around. We're looking forward to FinOps, talking about updates to Consul, WIF coming to Vault 1.17, and giving an intro to Databricks LakeFlow. Because we needed another lake product. Be sure to stick around for this week's Cloud Journey series too.  Titles we almost went with this week: The CloudPod lets the DataLake flow Amazon attempts an international incident in Taiwan What's your Vector Mysql?  A big thanks to this week's sponsor: We're sponsorless! Want to reach a dedicated audience of cloud engineers? Send us an email, or hit us up on our Slack Channel and let's chat!  General News 01:40 Consul 1.19 improves Kubernetes workflows, snapshot support, and Nomad integration Consul 1.19 is now generally available, improving the user experience, providing flexibility and enhancing integration points.  Consul 1.19 introduces a new registration custom resource definition (CRD) that simplifies the process of registering external services into the mesh.   Consul service mesh already supports routing to services outside of the mesh through terminating gateways. However, there are advantages to using the new Registration CRD.  Consul snapshots can now be stored in multiple destinations, previously, you could only snapshot to a local path or to a remote object store destination but not both.   Now you can take a snapshot of NFS Mounts, San attached Storage, or Object storage.  Consul API gateways can now be deployed on Nomad, combined with transparent proxy and enterprise features like admin partitions  01:37 Matthew- “What I was surprised about, which I did not know, was that console API gateway can now be deployed on Nomad. Was it not able to be deployed before? Just feels weird… you know, consoles should be able to be deployed on nomad compared to that. You know, it’s all the same company, but sometimes team A doesn’t always talk to team B.” 03:21 Vault 1.17 brings WIF, EST support for PKI, and more   Vault 1.17 is now generally available with new secure workflows, better performance and improved secrets management scalability.  Key new features: Workload Identify Federation (WIF) allows you to eliminate concerns around providing security credentials to vault plugins.   Using the new support for WIF< a trust relationship can be established between an external system and va

Is this Top Performing Stock about to Drop on Forecasts? This company's share price has risen by over 200% in the last 8 months on very strong results but their revenune is forecast to drop by 19% this year and operating profit is due to fall by 47%. This is company looks like a quality business with good margins and a decent client base but are investors aware that this years forecasted results will not be as strong? Intercede #IGP is a cybersecurity software company specialising in digital identities, and its innovative solutions enable organisations to protect themselves against the number one cause of data breach: compromised user credentials. The Intercede suite of products allows customers to choose the level of security that best fits their needs, from Secure Registration and ID Verification to Password Security Management, One-Time Passwords, FIDO and PKI. Uniquely, Intercede provides the entire set of authentication options from Passwords to PKI, supporting customers on their journey to passwordless and stronger authentication environments. If you want to make money in the stock market, you have to avoid these two mistakes. Investors who lose money in the stock market always make these mistakes. They are relatively easy to correct. See the video below called: Investors Avoid These Two Mistakes. My name is Justin Waite, I am a UK based private investor who specialises in microcap stocks (stock with a market capitalisation of £100m). I also run The Sharepickers Investment Club which aims to teach people how to invest, or to help current investors to improve their skill. My 3-step, WHAT, WHEN, HOW strategy helps people avoid the most common investors mistakes. I also host a live weekly webinar to cover potential investment ideas and various aspects of investing. Each company looked at is analysed across 20 metrics, then scored, coloured coded and ranked on the MicroCap League. Members of The SharePickers Investment Club also receive Justin's investment book: How to become a Microcap Millionaire - A 3 Step Strategy to Stock Market Success It teaches you: WHAT are the best UK stocks to invest into using fundamental analysis WHEN is the very best time to invest using technical analysis HOW to manage your investments using portfolio management. In the book Justin explains how his Stocks and Share ISA went from £30,115 in 2009 to £2,751,467 on the 1st May 2021. On the website there's also videos on how to learn about fundamental analysis and technical analysis. To get 20% off your membership to the SharePickers Investment Club go to www.sharepickers.com/subscribe and sign up for my free cheat sheet.

FIDO security keys are not new in the authentication workflow. They have been around now for 10 years. What is new is the combination of the most secure multi-factor authentication method not only for logical but also for physical access control with the highest FIPS140-3 security certification in the market. Segment Resources: Video "Swissbit iShield Key Pro: Protecting Digital Identities" https://www.youtube.com/watch?v=kxtqOyZ6e80 This segment is sponsored by Swissbit. Visit https://securityweekly.com/swissbitidv to learn more about them! While AI artificial intelligence is up-and-coming, automating your organization's PKI infrastructure is very much a reality, and can help save your IT team on hardware costs and employee costs in the long term. Additionally, a powerful PKI-as-a-Service solution provides the cryptoagility your organization can rely on as artificial intelligence, post-quantum computing, and shortened certificate validity periods become reality. This segment is sponsored by HID. Visit https://securityweekly.com/hididv to learn more about them! Cyberattacks, fraud and breaches, we've all studied them, and we are all aware that identity is under attack. And if we thought it was bad up until now, we haven't fully seen the impact of GenAI based identity attacks. Going beyond just Deepfakes, GenAI-powered malicious services such as FraudGPT, lets novices craft targeted and sophisticated attacks that bypass common IAM and security controls. Identity and security leaders must brace themselves for an increase in the volume, velocity and variety of attacks ("the three V's:). In this talk, former Gartner analyst David Mahdi and CIO of Transmit Security cover what you need to know about GenAI these attacks, and what you can do about it. Specifically, the types of attacks fraudsters are conducting across the identity lifecycle, insight into their tactics and services, and finally recommendations for a path forward. This segment is sponsored by Transmit Security. Visit https://securityweekly.com/transmitidv to learn more about them! Show Notes: https://securityweekly.com/vault-esw-13

FIDO security keys are not new in the authentication workflow. They have been around now for 10 years. What is new is the combination of the most secure multi-factor authentication method not only for logical but also for physical access control with the highest FIPS140-3 security certification in the market. Segment Resources: Video "Swissbit iShield Key Pro: Protecting Digital Identities" https://www.youtube.com/watch?v=kxtqOyZ6e80 This segment is sponsored by Swissbit. Visit https://securityweekly.com/swissbitidv to learn more about them! While AI artificial intelligence is up-and-coming, automating your organization's PKI infrastructure is very much a reality, and can help save your IT team on hardware costs and employee costs in the long term. Additionally, a powerful PKI-as-a-Service solution provides the cryptoagility your organization can rely on as artificial intelligence, post-quantum computing, and shortened certificate validity periods become reality. This segment is sponsored by HID. Visit https://securityweekly.com/hididv to learn more about them! Cyberattacks, fraud and breaches, we've all studied them, and we are all aware that identity is under attack. And if we thought it was bad up until now, we haven't fully seen the impact of GenAI based identity attacks. Going beyond just Deepfakes, GenAI-powered malicious services such as FraudGPT, lets novices craft targeted and sophisticated attacks that bypass common IAM and security controls. Identity and security leaders must brace themselves for an increase in the volume, velocity and variety of attacks ("the three V's:). In this talk, former Gartner analyst David Mahdi and CIO of Transmit Security cover what you need to know about GenAI these attacks, and what you can do about it. Specifically, the types of attacks fraudsters are conducting across the identity lifecycle, insight into their tactics and services, and finally recommendations for a path forward. This segment is sponsored by Transmit Security. Visit https://securityweekly.com/transmitidv to learn more about them! Show Notes: https://securityweekly.com/vault-esw-13

FIDO security keys are not new in the authentication workflow. They have been around now for 10 years. What is new is the combination of the most secure multi-factor authentication method not only for logical but also for physical access control with the highest FIPS140-3 security certification in the market. Segment Resources: Video "Swissbit iShield Key Pro: Protecting Digital Identities" https://www.youtube.com/watch?v=kxtqOyZ6e80 This segment is sponsored by Swissbit. Visit https://securityweekly.com/swissbitidv to learn more about them! While AI artificial intelligence is up-and-coming, automating your organization's PKI infrastructure is very much a reality, and can help save your IT team on hardware costs and employee costs in the long term. Additionally, a powerful PKI-as-a-Service solution provides the cryptoagility your organization can rely on as artificial intelligence, post-quantum computing, and shortened certificate validity periods become reality. This segment is sponsored by HID. Visit https://securityweekly.com/hididv to learn more about them! Cyberattacks, fraud and breaches, we've all studied them, and we are all aware that identity is under attack. And if we thought it was bad up until now, we haven't fully seen the impact of GenAI based identity attacks. Going beyond just Deepfakes, GenAI-powered malicious services such as FraudGPT, lets novices craft targeted and sophisticated attacks that bypass common IAM and security controls. Identity and security leaders must brace themselves for an increase in the volume, velocity and variety of attacks ("the three V's:). In this talk, former Gartner analyst David Mahdi and CIO of Transmit Security cover what you need to know about GenAI these attacks, and what you can do about it. Specifically, the types of attacks fraudsters are conducting across the identity lifecycle, insight into their tactics and services, and finally recommendations for a path forward. This segment is sponsored by Transmit Security. Visit https://securityweekly.com/transmitidv to learn more about them! Show Notes: https://securityweekly.com/vault-esw-12

FIDO security keys are not new in the authentication workflow. They have been around now for 10 years. What is new is the combination of the most secure multi-factor authentication method not only for logical but also for physical access control with the highest FIPS140-3 security certification in the market. Segment Resources: Video "Swissbit iShield Key Pro: Protecting Digital Identities" https://www.youtube.com/watch?v=kxtqOyZ6e80 This segment is sponsored by Swissbit. Visit https://securityweekly.com/swissbitidv to learn more about them! While AI artificial intelligence is up-and-coming, automating your organization's PKI infrastructure is very much a reality, and can help save your IT team on hardware costs and employee costs in the long term. Additionally, a powerful PKI-as-a-Service solution provides the cryptoagility your organization can rely on as artificial intelligence, post-quantum computing, and shortened certificate validity periods become reality. This segment is sponsored by HID. Visit https://securityweekly.com/hididv to learn more about them! Cyberattacks, fraud and breaches, we've all studied them, and we are all aware that identity is under attack. And if we thought it was bad up until now, we haven't fully seen the impact of GenAI based identity attacks. Going beyond just Deepfakes, GenAI-powered malicious services such as FraudGPT, lets novices craft targeted and sophisticated attacks that bypass common IAM and security controls. Identity and security leaders must brace themselves for an increase in the volume, velocity and variety of attacks ("the three V's:). In this talk, former Gartner analyst David Mahdi and CIO of Transmit Security cover what you need to know about GenAI these attacks, and what you can do about it. Specifically, the types of attacks fraudsters are conducting across the identity lifecycle, insight into their tactics and services, and finally recommendations for a path forward. This segment is sponsored by Transmit Security. Visit https://securityweekly.com/transmitidv to learn more about them! Show Notes: https://securityweekly.com/vault-esw-12

In Folge 3 betrachten Christopher und Sylvester im Newsteil den Rausschmiß einer CA aus den Browsern und warum das nicht nur positiv ist. Außerdem erzählen die beiden Security-Podcaster, wie sie Microsofts Recall finden. Im Hauptteil geht es um eine teure und lästige Art der Online-Attacke: Denial of Service. Die Hosts diskutieren, welche Arten von DoS es gibt, wie Angreifer mit wenig Aufwand terabiteweise Daten auf ihre Opfer schleudern und ob man sich gegen DoS-Angriffe schützen kann.

In this episode, we delve into the pressing economic indicators suggesting stagflation and a potential recession. We review key data from auto sales, construction spending, and factory orders, and discuss the upcoming jobs report and its implications. The discussion also covers important earnings reports from companies like Cloud Strike, Dollar Tree, and Lululemon, providing insights into consumer behavior and spending patterns. Tune in as we analyze the current economic landscape and what it means for the future. [00:00:04] Overview of upcoming economic data and earnings reports. [00:00:47] Live stream announcement: Discussing the 2025 housing market bloodbath predictions. [00:01:35] Insights into the job market with upcoming JOLTS report, factory orders, and auto sales. [00:02:34] Importance of the ADP report and initial jobless claims as economic indicators. [00:03:30] Expectations for the jobs number and unemployment rate. [00:04:01] Discussion on the earnings reports from Cloud Strike, PVH, Dollar Tree, and Lululemon. [00:05:56] Analysis of PKI data and its implications for inflation and stagflation. [00:07:03] Review of Chicago PMI numbers and historical accuracy in predicting recessions. [00:10:34] Trends in consumer behavior: Trading down from high-end to lower-end retailers. [00:11:02] Introduction to the One Rental at a Time school community and its benefits. One Rental at a Time One Rental at a Time School Cloud Strike PVH Corp Dollar Tree Lululemon DocuSign Chicago PMI Thank you for tuning into this episode as we navigate the complexities of the current economic landscape. If you enjoyed this discussion, please rate, follow, share, and leave a review. Your feedback helps us continue to bring you valuable content. For more detailed discussions and to connect with industry experts, join the One Rental at a Time school community. Stay informed, stay prepared, and see you next time!

In this episode of the Access Control Podcast, Ben Arent sits down with Ben Burkert and Chris Stolt, the founders of Anchor Security, to discuss the challenges of managing internal TLS and how private CAs can help simplify the process. Ben and Chris share their experiences dealing with certificate-related outages and the frustrations that led them to start Anchor. They provide an in-depth look at the evolution of web cryptography, from the early days of SSL to the modern era of TLS and the impact of Let's Encrypt and the ACME protocol. The conversation also covers the benefits of using private CAs for internal PKI, including shorter certificate lifetimes, enhanced security, and improved developer experience. Ben and Chris introduce Anchor's new tool, lcl.host, which streamlines local TLS setup for developers. Throughout the episode, Ben and Chris offer practical advice for teams looking to implement internal PKI and MTLS, including best practices for certificate hierarchy design, tips for getting started, and the importance of testing your incident response and key rotation processes. Whether you're a developer, ops engineer, or security professional, this episode provides valuable insights into the world of internal TLS and how private CAs can help you secure your infrastructure more effectively. Tune in to learn from Anchor's experts and discover how to simplify your internal PKI management.

In today's episode, we delve into the question: Is the consumer broke? We analyze recent earnings reports from key retailers like Best Buy, Foot Locker, and Kohl's to understand consumer behavior amidst economic changes. We also explore trends in enterprise software spending and the implications of recent reports from Salesforce and UiPath. Additionally, we discuss the potential impact of upcoming PKI core data on the market and share insights on GDP revisions and jobless claims. Tune in for a comprehensive look at the current state of the consumer economy and what it means for the future. [00:00:00] Introduction and overview of today's topics: consumer spending, enterprise software, and the upcoming PKI core data. [00:00:51] Discussion on changes in consumer behavior post-pandemic and its impact on discretionary spending. [00:02:15] Best Buy's earnings: Miss on revenue, beating earnings, and highlighting consumer pullback on discretionary items. [00:03:15] Foot Locker's earnings: Matched revenue, beat earnings, and the CEO's focus on margins and retail pricing. [00:04:20] Kohl's earnings: Miss on revenue and earnings, guidance cut, and same-store sales down 5.3%. [00:05:36] Analysis of consumer spending trends in grocery versus discretionary items based on Target and Walmart reports. [00:06:37] Salesforce's earnings: Miss on revenue and weak forecast due to a measured buying environment. [00:08:21] UiPath's challenges: CEO resignation and weak performance report. [00:08:50] Mixed results in tech earnings: New Topic's weak guidance versus HP Inc. and Pure Storage's strong performance. [00:09:14] Conclusion on consumer spending: Differentiating between asset owners and renters, and the impact on discretionary spending. Best Buy Foot Locker Kohl's Salesforce UiPath One Rental at a Time School Thank you for joining us in today's episode as we explored the state of the consumer economy. If you found this discussion insightful, please rate, follow, share, and leave a review. Your feedback helps us bring you more valuable content. For further insights and to connect with industry experts, join the One Rental at a Time School community. See you next time!

The DOJ indicts four Iranian nationals on hacking charges. Legislation to ban or force the sale of TikTok heads to the President's desk. A Russian hack group claims a cyberattack on an Indiana water treatment plant. A roundup of dark web data leaks. Mandiant monitors dropping dwell times. Bcrypt bogs down brute-forcing. North Korean hackers target defense secrets. On our Learning Layer segment, host Sam Meisenberg and Joe Carrigan continue their discussion of Joe's ISC2 CISSP certification journey. On our Industry Voices segment, Tony Velleca, CEO of CyberProof, joins us to explore some of the pain points that CISOs & CIOs are experiencing today, and how they can improve their cyber readiness. Ransomware may leave the shelves in Sweden's liquor stores bare.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guests Learning Layer On our Learning Layer segment, host Sam Meisenberg and Joe Carrigan continue their discussion of Joe's ISC2 CISSP certification journey using N2K's comprehensive CISSP training course, CISSP practice test, and CISSP practice labs. Sam and Joe discuss content and study strategies for CISSP Domain 3 Security Architecture and Engineering, and discuss encryption and non-repudiation. Specifically they cover sub-domain 3.6, "Select and determine cryptographic solutions," which includes: Cryptographic life cycle Cryptographic method Public key infrastructure (PKI). Industry Voices On our Industry Voices segment, Tony Velleca, CEO of CyberProof, joins us to explore some of the pain points that CISOs & CIOs are experiencing today, and how they can improve their cyber readiness.  Selected Reading Rewards Up to $10 Million for Information on Iranian Hackers (GB Hackers) Congress passes bill that could ban TikTok after years of false starts (Washington Post) Russian hackers claim cyberattack on Indiana water plant (The Record) Major Data Leaks from Honda Vietnam, US Airports, and Chinese Huawei/iPhone Users (SOCRadar® Cyber Intelligence Inc.) Global attacker median dwell time continues to fall (Help Net Security) New Password Cracking Analysis Targets Bcrypt (SecurityWeek) North Korean Hackers Target Dozens of Defense Companies (Infosecurity Magazine) ​​Hackers hijack antivirus updates to drop GuptiMiner malware (Bleeping Computer) Sweden's liquor shelves to run empty this week due to ransomware attack (The Record) Share your feedback. We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.  Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here's our media kit. Contact us at cyberwire@n2k.com to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Soekarno membekukan Partai Murba pada September 1965 atas beberapa tuduhan, salah satunya menerima uang 100 juta dolar Amerika Serikat dari CIA untuk menggulingkan Sang Proklamator. Pertentangan antara Murba dan PKI sangat tajam jelang dan selama awal 60-an. Ketika PKI semakin kuat, Murba menginisiasi kerja sama dengan militer dan pihak lainnya untuk menjegal PKI dengan membentuk Badan Pendukung Soekarnoisme (BPS) yang ternyata kurang disukai Soekarno. 7 November 1948, Tan Malaka, Chaerul Saleh, Sukarni, dan Adam Malik menjadi pelopor pendirian Partai Musyawarah Rakyat Banyak atau Murba. Partai Murba mengusung ideologi unik racikan Tan Malaka yang merupakan paham sosialisme yang disesuaikan dengan kondisi Indonesia saat itu. Sempat dibekukan pada September 1965, setahun kemudian Partai Murba direhabilitasi oleh pemerintah dalam masa peralihan dari Soekarno ke Soeharto. Hasil Pemilu 1955 yang tak memuaskan, diikuti oleh capaian yang tak berbeda di Pemilu 1971. Kegagalan Partai Murba jamak dinilai karena stigma rezim Orde Baru terhadap golongan kiri, sebelum akhirnya Murba dilebur ke dalam Partai Demokrasi Indonesia atau PDIP pada tahun 1973.

Michael chats with Mike Nelson, Vice President of Digital Trust at DigiCert. In this episode, Michael and Mike discuss the latest cybersecurity regulations surrounding medical devices, how public key infrastructure (PKI) connects compliance and security to help medical device manufacturers meet those regulations, the meaning of “crypto-agility” and how it helps organizations adapt to and defend against cybersecurity threats, and much more. This episode is sponsored by DigiCert, digicert.com.   Visit with DigiCert at booth #1636 in the Cyber Command Center at HIMSS, March 11–15, in Orlando.   The views in this podcast do not necessarily reflect those of our sponsors.

The federal government poses unique challenges in identity management. They are constrained by heavy security, a surfeit of data, and, most importantly, a limited budget. Today's interview takes all three aspects into account and offers listeners creative solutions to solve the vexing crisis in federal identity management. One of the first concerns is mobility. This does not just apply to military operations which, by definition, will be all over the world. Today's civilian agencies like FEMA have emergency remote users as well as many employees and contractors working remotely. The initial secure environment includes PKI processes that work well on a desktop system; now so much on a mobile. During the interview, it was suggested that a centralized model of identity verification may be the solution that can manage circumstances that do not include desktop computers. In a nod to the human condition, it was observed that if the identity solution is not convenient or will be subverted. SailPoint's Frank Brugulio points out that once a stable initial process is designed, then one must worry about continuous monitoring. The federal government includes legacy systems that may not work with new identity management systems, and a person's attributes may change, What the first federal systems designers never imagined is a fact brought out by James Imanian from CyberArk. He states that today, we must deal with forty-five machine identities for each human. When you throw all these factors together, you must understand that we are dealing with a limited budget and staff. Well deployed artificial intelligence can do menial tasks like recognizing unauthorized devices, advanced logging analytics, some sticky compliance issues.  

Wes was the sole founder in 1981 of Delphi Internet Services Corporation, "The Company That Popularized The Internet" according to Michael Woolf, and was the creator of the world's first online encyclopedia. At the time it was sold to Rupert Murdoch's News Corporation in 1993, Delphi had been profitable for years and was among the four largest social networks, along with AOL, CompuServe and Prodigy. In 1986, while CEO of Delphi, Wes launched a spinoff, Global Villages, Inc. to serve magazine publishers and business clients with their own private-label social networks. Wes focused the attention of his new team on the need for reliable identities of individuals on the Internet, starting with the development of the VIVOS Enrollment Workstation. While developing VIVOS, Wes began collecting source material for a book about a hypothetical world public key infrastructure, built upon digital certificates representing measurably reliable identities, which would bring authenticity to online interactions and privacy to individuals. As the book began to take shape Wes was introduced to a group at the International Telecommunication Union that was attempting to implement a world PKI that was similar to the one he envisioned. Wes was subsequently appointed to the High Level Experts Group at the ITU's Global Cybersecurity Agenda. In an address in 2008 to the United Nations World Summit on Information Society in Geneva, Wes introduced the City of Osmio, a new certification authority. Wes's book, entitled Quiet Enjoyment, published in 2004 with a second edition in 2014, was followed by Wes's other titles including Don't Get Norteled in 2013 and Escape The Plantation in 2014.   Scott Schober is an author, CEO of www.bvsystems.com and #cybersecurity expert that appears regularly on Bloomberg TV, Fox Business & Fox News, CCTV America, Canadian TV News, Al Jazeera America, Arise TV as well as CNN, CBS Morning Show, MSNBC, CNBC, The Blaze, WPIX as well as local and syndicated Radio including Sirius/XM & Bloomberg Radio and NPR. Scott has also authored 3 critically acclaimed cybersecurity books entitled Hacked Again, Cybersecurity is Everybody's Business and Senior Cyber all available on Amazon. @ScottBVS www.linkedin.com/in/snschober www.facebook.com/SeniorCyberBook www.instagram.com/scott_schober www.ScottSchober.com

Wes was the sole founder in 1981 of Delphi Internet Services Corporation, "The Company That Popularized The Internet" according to Michael Woolf, and was the creator of the world's first online encyclopedia. At the time it was sold to Rupert Murdoch's News Corporation in 1993, Delphi had been profitable for years and was among the four largest social networks, along with AOL, CompuServe and Prodigy. In 1986, while CEO of Delphi, Wes launched a spinoff, Global Villages, Inc. to serve magazine publishers and business clients with their own private-label social networks. Wes focused the attention of his new team on the need for reliable identities of individuals on the Internet, starting with the development of the VIVOS Enrollment Workstation. While developing VIVOS, Wes began collecting source material for a book about a hypothetical world public key infrastructure, built upon digital certificates representing measurably reliable identities, which would bring authenticity to online interactions and privacy to individuals. As the book began to take shape Wes was introduced to a group at the International Telecommunication Union that was attempting to implement a world PKI that was similar to the one he envisioned. Wes was subsequently appointed to the High Level Experts Group at the ITU's Global Cybersecurity Agenda. In an address in 2008 to the United Nations World Summit on Information Society in Geneva, Wes introduced the City of Osmio, a new certification authority. Wes's book, entitled Quiet Enjoyment, published in 2004 with a second edition in 2014, was followed by Wes's other titles including Don't Get Norteled in 2013 and Escape The Plantation in 2014. Scott Schober is an author, CEO of www.bvsystems.com and #cybersecurity expert that appears regularly on Bloomberg TV, Fox Business & Fox News, CCTV America, Canadian TV News, Al Jazeera America, Arise TV as well as CNN, CBS Morning Show, MSNBC, CNBC, The Blaze, WPIX as well as local and syndicated Radio including Sirius/XM & Bloomberg Radio and NPR. Scott has also authored 3 critically acclaimed cybersecurity books entitled Hacked Again, Cybersecurity is Everybody's Business and Senior Cyber all available on Amazon. @ScottBVS www.linkedin.com/in/snschober www.facebook.com/SeniorCyberBook www.instagram.com/scott_schober www.ScottSchober.com

Summary In this episode, the hosts discuss the Cloudflare and Okta breach, the response and remediation efforts, the introduction of the Intune Suite, and the new stolen device protection feature on the iPhone. Takeaways Nation-state attackers have unlimited time to find weaknesses and exploit them, highlighting the asymmetrical nature of cybersecurity. Cloudflare's response and remediation efforts, including re-imaging and rebooting all systems on their global network, were impressive. The Intune Suite offers enterprise application management, advanced analytics, and cloud PKI, providing valuable tools for device management. The stolen device protection feature on the iPhone adds an extra layer of security by requiring biometric authentication for critical changes when the device is away from a familiar location. ------------------------------------------- Youtube Video Link: ⁠⁠⁠⁠⁠⁠https://youtu.be/n9dDfmX-A9Q⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ------------------------------------------- Documentation: https://blog.cloudflare.com/thanksgiving-2023-security-incident https://www.microsoft.com/en-us/security/blog/2024/02/01/3-new-ways-the-microsoft-intune-suite-offers-security-simplification-and-savings/ https://support.apple.com/en-us/HT212510 ---------------------- Contact Us: Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://bluesecuritypod.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Twitter: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://twitter.com/bluesecuritypod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Threads: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.threads.net/@bluesecuritypodcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Linkedin: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/company/bluesecpod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Youtube: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.youtube.com/c/BlueSecurityPodcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Twitch: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.twitch.tv/bluesecuritypod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ------------------------------------------- Andy Jaw Mastodon: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://infosec.exchange/@ajawzero⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Twitter: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://twitter.com/ajawzero⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/andyjaw/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Email: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠andy@bluesecuritypod.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ------------------------------------------- Adam Brewer Twitter: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://twitter.com/ajbrewer⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/adamjbrewer/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Email: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠adam@bluesecuritypod.com --- Send in a voice message: https://podcasters.spotify.com/pod/show/blue-security-podcast/message

Welcome to the latest episode of the Canadian Investor podcast with your hosts, Dan and Simon. Tune in as they delve into the latest financial updates and earnings reports. In this episode, they analyze Birchcliff's significant dividend cut, break down TSMC's earnings, unpack the shareholder feud at Parkland Fuel, dissect Goldman Sachs' financial performance, and share insights from a recent interview with CIBC's Deputy Chief Economist, Benjamin Tal, featured in The Globe and Mail. Stay informed and engaged with the Canadian Investor podcast as Dan and Simon navigate through the dynamic landscape of financial news and discussions. Ticker of Stocks discussed: TSMC, GS, PKI.TO, BIR.TO Check out our portfolio by going to Jointci.com Our Website Canadian Investor Podcast Network Twitter: @cdn_investing Simon's twitter: @Fiat_Iceberg Braden's twitter: @BradoCapital Dan's Twitter: @stocktrades_ca Want to learn more about Real Estate Investing? Check out the Canadian Real Estate Investor Podcast! Apple Podcast - The Canadian Real Estate Investor  Spotify - The Canadian Real Estate Investor  Sign up for Finchat.io for free to get easy access to global stock coverage and powerful AI investing tools. Register for EQ Bank, the seamless digital banking experience with better rates and no nonsense.See omnystudio.com/listener for privacy information.

In this episode we explore whether a managed PKI provider should give complete control over PKI decisions to the end customer or if it should enforce certain minimum standards and principles regardless of what the customer asks for.

Our hosts firmly believe that PKI is a necessary component of all digital interactions. And yet there are still gaps in PKI implementation. We discuss these gaps and why they persist.

Stacy is a self starter with a passion for cyber security. Co-Founder of Connected Transport Business Unit at Irdeto. Evangelist and active speaker on cyber security for the connected transportation space. Strong and demonstrated Stacy Janes, Head of Security at Waymo technical history in cyber security areas such as PKI, authentication/authorization, end-point security and ethical hacking. Proven history of building teams to solve difficult industry problems.  For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e266

We look forward to 2024 and predict trends for PKI, certificates, and digital identity. We discuss shortening certificate lifespans, Multi-perspective Domain Validation (MPDV), eIDAS 2.0, OCSP, post-quantum cryptography (PQC), Certificate Lifecycle Management (CLM), passwords, root stores, and government versus encryption. Plus, will Jason be sent to the gulag for not being Canadian enough?

Mike is CEO of SecureG, which is building cryptography solutions for communications infrastructure. In the episode we discuss their work with root of trust solutions and how the company is evolving towards more unique technology in building a PKI trust infrastructure for wireless.This episode was recorded live at Blu Ventures' Cyber Venture Forum event in October. Thank you again to the Blu team! https://secureg.io/

GDPR provides a "right to be forgotten," whereby individuals can demand the removal of PII from IT systems. This can run directly contrary to the transparency and permanence built into the DNA of public PKI systems. We explore this conundrum.

We look back at PKI in 2023. Trends include artificial intelligence, enterprise crypto agility, the fall of OCSP, PKI everywhere, the weakness of passwords, and government versus the internet. We also look at last year's predictions and compare them to the year's events.

Feeling the frustration of constantly battling memory-related vulnerabilities in your code? What if I told you there's an unexpected twist in the story that could change everything? Join me as we explore the captivating journey of transitioning to memory-safe languages in programming, and uncover the game-changing solution that awaits. But that's a story for another time...Our special guest is Loren Kohnfelder and joined by Roger Grimes.Loren Kohnfelder, a distinguished figure in the realm of cybersecurity, is widely regarded as a trailblazer in the development of PKI (Public Key Infrastructure). His significant contributions to the RSA algorithm and its application in real-world scenarios have solidified his position as a thought leader in digital security. With extensive expertise in encryption and network systems, Loren offers a wealth of knowledge for developers seeking to navigate the transition to memory-safe languages. His pioneering work serves as a cornerstone in understanding the complexities of cybersecurity and the pivotal role of memory-safe languages in fortifying software against vulnerabilities. Loren's profound insights and experiences make him an exceptional guest, providing a comprehensive understanding of the evolution of digital security and its relevance to memory-safe languages.I think if there are specific pieces of code that are well contained and you can rewrite those in a memory safe language, that's a fine thing to do. But, for example, if you've got a library that's in the middle of a bunch of memory unsafe language code, and you write that into memory safe code, you're going to have bridge code connecting across that boundary, because you obviously can't just slip from memory safe land into memory unsafe land, where you're now taking on risk without managing those borders. - Loren KohnfelderIn this episode, you will be able to:Uncover the secrets of PKI with Loren Kohnfelder.Learn the benefits of transitioning to memory-safe languages.Overcome the challenges of rewriting large codebases.Explore the feasibility of adopting memory-safe languages in programming.Connect with usWebsite: securitymasterminds.buzzsprout.comKnowBe4 Resources:KnowBe4 Blog: https://blog.knowbe4.comJames McQuiggan - https://www.linkedin.com/in/jmcquigganRoger Grimes: https://www.linkedin.com/in/rogeragrimes/Erich Kron - https://www.linkedin.com/in/erichkronJelle Wieringa - https://www.linkedin.com/in/jellewieringaJavvad Malik: https://www.linkedin.com/in/javvadMusic Composed by: Brian Sanyshyn - https://www.briansanyshynmusic.comAnnouncer: Sarah McQuiggan - https://www.sarahmcquiggan.com

Dale Peterson was recently interviewed by Jay Johnson of Sandia and Tom Tansy of the Sunspec Alliance as part of their distributed energy resources (DER) Sunspec webinar series. We covered a lot of issues and Dale was not shy in throwing out some analysis and opinions. After 5 minutes discussing the S4x24 ticket process, the topics discussed:   How DER will deal with the complex, large number of users and stakeholders PKI environment. The Sunspec device security specification and the benefits of a limited, key set of security controls. What is the role of government regulation to solve DER security issues? The potential power of the utility companies to levy requirements and be a choke point for access. The Patch Act, FDA and DER. shift left and product liability due to security flaws and more

As Chief Experience Officer of Sectigo, Tim Callan leads efforts to optimize the customer journey across all aspects of the business. Tim has more than 20 years of experience as a strategic marketing and product leader for successful B2B software and SaaS companies, with 15 years of experience in the SSL and PKI technology spaces.Advertisers:https://gozynta.com/eureka/https://twingate.com/podcast/Do you want the show on your podcast app or the written versions of the stories? Subscribe to the Business of Tech: https://www.businessof.tech/subscribe/Support the show on Patreon: https://patreon.com/mspradio/Want our stuff? Cool Merch? Wear “Why Do We Care?” - Visit https://mspradio.myspreadshop.comFollow us on:Facebook: https://www.facebook.com/mspradionews/Twitter: https://twitter.com/mspradionews/Instagram: https://www.instagram.com/mspradio/LinkedIn: https://www.linkedin.com/company/28908079/

Welcome to the newest episode of The Cloud Pod podcast - where the forecast is always cloudy! Today your hosts Justin, Jonathan, and Matt discuss all things cloud and AI, as well as some really interesting forays into quantum computing, changes to Google domains, Google accusing Microsoft of cloud monopoly shenanigans, and the fact that Azure wants all your industry secrets. Also, Finops and all the logs you could hope for. Are your secrets safe? Better tune in and find out!  Titles we almost went with this week: The Cloud Pod Adds Domains to the Killed by Google list The Cloud Pod Whispers it's Secrets to Azure OpenAI The Cloud Pod Accuses the Cloud of Being a Monopoly The Cloud Pod Does Not Pass Go and Does Not collect $200 A big thanks to this week's sponsor: Foghorn Consulting, provides top-notch cloud and DevOps engineers to the world's most innovative companies. Initiatives stalled because you have trouble hiring?  Foghorn can be burning down your DevOps and Cloud backlogs as soon as next week.

Jonathan (Koz) Kozolchyk, General Manager for Certificate Services at AWS, joins Corey on Screaming in the Cloud to discuss the best practices he recommends around certificates. Jonathan walks through when and why he recommends private certs, and the use cases where he'd recommend longer or unusual expirations. Jonathan also highlights the importance of knowing who's using what cert and why he believes in separating expiration from rotation. Corey and Jonathan also discuss their love of smart home devices as well as their security concerns around them and how they hope these concerns are addressed moving forward. About JonathanJonathan is General Manager of Certificate Services for AWS, leading the engineering, operations, and product management of AWS certificate offerings including AWS Certificate Manager (ACM) AWS Private CA, Code Signing, and Encryption in transit. Jonathan is an experienced leader of software organizations, with a focus on high availability distributed systems and PKI. Starting as an intern, he has built his career at Amazon, and has led development teams within our Consumer and AWS businesses, spanning from Fulfillment Center Software, Identity Services, Customer Protection Systems and Cryptography. Jonathan is passionate about building high performing teams, and working together to create solutions for our customers. He holds a BS in Computer Science from University of Illinois, and multiple patents for his work inventing for customers. When not at work you'll find him with his wife and two kids or playing with hobbies that are hard to do well with limited upside, like roasting coffee.Links Referenced: AWS website: https://www.aws.com Email: mailto:koz@amazon.com Twitter: https://twitter.com/seakoz TranscriptAnnouncer: Hello, and welcome to Screaming in the Cloud with your host, Chief Cloud Economist at The Duckbill Group, Corey Quinn. This weekly show features conversations with people doing interesting work in the world of cloud, thoughtful commentary on the state of the technical world, and ridiculous titles for which Corey refuses to apologize. This is Screaming in the Cloud.Corey: In the cloud, ideas turn into innovation at virtually limitless speed and scale. To secure innovation in the cloud, you need Runtime Insights to prioritize critical risks and stay ahead of unknown threats. What's Runtime Insights, you ask? Visit sysdig.com/screaming to learn more. That's S-Y-S-D-I-G.com/screaming.My thanks as well to Sysdig for sponsoring this ridiculous podcast.Corey: Welcome to Screaming in the Cloud. I'm Corey Quinn. As I record this, we are about a week and a half from re:Inforce in Anaheim, California. I am not attending, not out of any moral reason not to because I don't believe in cloud security or conferences that Amazon has that are named after subject lines, but rather because I am going to be officiating a wedding on the other side of the world because I am an ordained minister of the Church of There Is A Problem With This Website's Security Certificate. So today, my guest is going to be someone who's a contributor, in many ways, to that religion, Jonathan Kozolchyk—but, you know, we all call him Koz—is the general manager for Certificate Services at AWS. Koz, thank you for joining me.Koz: Happy to be here, Corey.Corey: So, one of the nice things about ACM historically—the managed service that handles certificates from AWS—is that for anything public-facing, it's free—which is always nice, you should not be doing upcharges for security—but you also don't let people have the private portion of the cert. You control all of the endpoints that terminate SSL. Whereas when I terminate SSL myself, it terminates on the floor because I've dropped things here and there, which means that suddenly the world of people exposing things they shouldn't or expiry concerns just largely seemed to melt away. What was the reason that Amazon looked around at the landscape and said, “Ah, we're going to launch our own certificate service, but bear with me here, we're not going to charge people money for it.” It seems a little bit out of character.Koz: Well, Amazon itself has been battling with certificates for years, long before even AWS was a thing, and we learned that you have to automate. And even that's not enough; you have to inspect and you have to audit, you need a controlled loop. And we learned that you need a closed loop to truly manage it and make sure that you don't have outages. And so, when we built ACM, we built it saying, we need to provide that same functionality to our customers, that certificates should not be the thing that makes them go out. Is that we need to keep them available and we need to minimize the sharp edges customers have to deal with.Corey: I somewhat recently caught some flack on one of the Twitter replacement social media sites for complaining about the user experience of expired SSL certs. Because on the one hand, if I go to my bank's website, and the response is that instead, the server is sneakyhackerman.com, it has the exact same alert and failure mode as, holy crap, this certificate reached its expiry period 20 minutes ago. And from my perspective, one of those is a lot more serious than the other. What also I wind up encountering is not just when I'm doing banking, but when I'm trying to read some random blog on how to solve a technical problem. I'm not exactly putting personal information into the thing. It feels like that was a missed opportunity, agree or disagree?Koz: Well, I wouldn't categorize it as a missed opportunity. I think one of the things you have to think about with security is you have to keep it simple so that everyone, whether they're a technologist or not, can abide by the rules and be safe. And so, it's much easier to say to somebody, “There's something wrong. Period. Stop.” versus saying there are degrees of wrongness. Now, that said, boy, do I wish we had originally built PKI and TLS such that you could submit multiple certificates to somebody, in a connection for example, so that you could always say, you know, my certificates can expire, but I've got two, and they're off by six months, for example. Or do something so that you don't have to close failed because the certificate expired.Corey: It feels like people don't tend to think about what failure modes are going to look like. Because, pfhh, as an expired certificate? What kind of irresponsible buffoon would do such a thing? But I've worked in enough companies where you have historically, the wildcard cert because individual certs cost money, once upon a time. So, you wound up getting the one certificate that could work on all of the stuff that ends in the same domain.And that was great, but then whenever it expired, you had to go through and find all the places that you put it and you always miss some, so things would break for a while and the corporate response was, “Ugh, that was awful. Instead of a one-year certificate, let's get a five-year or a ten-year certificate this time.” And that doesn't make the problem better; it makes it absolutely worse because now it proliferates forever. Everyone who knows where that thing lives is now long gone by the time it hits again. Counterintuitively, it seems the industry has largely been moving toward short-lived certs. Let's Encrypt, for example, winds up rotating every 90 days, by my estimation. ACM is a year, if memory serves.Koz: So, ACM certs are 13 months, and we start rotating them around the 11th month. And Let's Encrypt offers you 90-day certs, but they don't necessarily require you to rotate every 90 days; they expire in 90 days. My tip for everybody is divorce expiration from rotation. So, if your cert is a 90-day cert, rotate it at 45 days. If your cert is a year cert, give yourself a couple of months before expiration to start the rotation. And then you can alarm on it on your own timeline when something fails, and you still have time to fix it.Corey: This makes a lot of sense in—you know, the second time because then you start remembering, okay, everywhere I use this cert, I need to start having alarms and alerts. And people are bad at these things. What ACM has done super well is that it removes that entire human from the loop because you control all of the endpoints. You folks have the ability to rotate it however often you'd like. You could have picked arbitrary timelines of huge amounts of time or small amounts of time and it would have been just fine.I mean, you log into an EC2 instance role and I believe the credentials get passed out of either a 6 or a 12-hour validity window, and they're consistently rotating on the back end and it's completely invisible to the customer. Was there ever thought given to what that timeline should be,j what that experience should be? Or did you just, like, throw a dart at a wall? Like, “Yeah, 13 months feels about right. We're going to go with that.” And never revisited it. I have a guess which—Koz: [laugh].Corey: Side of that it was. Did you think at all about what you were doing at the time, or—yeah.Koz: So, I will admit, this happened just before I got there. I got to ACM after—Corey: Ah, blame the predecessor. Always a good call.Koz: —the launch. It's a God-given right to blame your predecessor.Corey: Oh, absolutely. It's their entire job.Koz: I think they did a smart job here. What they did was they took the longest lifetime cert that was then allowed, at 13 months, knowing that we were going to automate the rotation and basically giving us as much time as possible to do it, right, without having to worry about scaling issues or having to rotate overly frequently. You know, there are customers who while I don't—I strongly disagree with [pinning 00:07:35], for example, but there are customers out there who don't like certs to change very often. I don't recommend pinning at all, but I understand these cases are out there, and changing it once every year can be easier on customers than changing it every 20 minutes, for example. If I were to pick an ideal rotation time, it'd probably be under ten days because an OCSP response is good for ten days and if you rotate before, then I never have to update an OCSP response, for example. But changing that often would play havoc with many systems because of just the sheer frequency you're rotating what is otherwise a perfectly valid certificate.Corey: It is computationally expensive to generate certificates at scale, I would imagine.Koz: It starts to be a problem. You're definitely putting a lot of load on the HSMs at that point, [laugh] when you're generating. You know, when you have millions of certs out in deployment, you're generating quite a few at a time.Corey: There is an aspect of your service that used to be part of ACM and now it's its own service—which I think is probably the right move because it was confusing for a lot of customers—Amazon looks around and sees who can we compete with next, it feels like sometimes. And it seemed like you were squarely focused on competing against your most desperate of all enemies, my crappy USB key where I used to keep the private CA I used at any given job—at the time; I did not keep it after I left, to be very clear—for whatever I'm signing things for certificates for internal use. You're, like, “Ah, we can have your crappy USB key as a service.” And sure enough, you wound up rolling that out. It seems like adoption has been relatively brisk on that, just because I see it in almost every client account I work with.Koz: Yeah. So, you're talking about the private CA offering which is—Corey: I—that's right. Private CA was the new service name. Yes, it used to be a private certificate authority was an aspect of ACM, and now you're—mmm, we're just going to move that off.Koz: And we split it out because like you said customers got confused. They thought they had to only use it with ACM. They didn't understand it was a full standalone service. And it was built as a standalone service; it was not built as part of ACM. You know, before we built it, we talked to customers, and I remember meeting with people running fairly large startups, saying, “Yes, please run this for me. I don't know why, but I've got this piece of paper in my sock drawer that one of my security engineers gave me and said, ‘if something goes wrong with our CA, you and two other people have to give me this piece of paper.'” And others were like, “Oh, you have a piece of paper? I have a USB stick in my sock drawer.” And like, this is what, you know, the startup world was running their CAs from sock drawers as far as I can tell.Corey: Yeah. A piece of paper? Someone wrote out the key by hand? That sounds like hell on earth.Koz: [sigh]. It was a sharding technique where you needed, you know, three of five or something like that to—Corey: Oh, they, uh, Shamir's Secret Sharing Service.Koz: Yes.Corey: The SSSS. Yeah.Koz: Yes. You know, and we looked at it. And the other alternative was people would use open-source or free certificate authorities, but without any of the security, you'd want, like, HSM backing, for example, because that gets really expensive. And so yeah, we did what our customers wanted: we built this service. We've been very happy with the growth it's taken and, like you said, we love the places we've seen it. It's gone into all kinds of different things, from the traditional enterprise use cases to IoT use cases. At one point, there's a company that tracks sheep and every collar has one of our certs in it. And so, I am active in the sheep-tracking industry.Corey: I am certain that some wit is going to comment on this. “Oh, there's a company out there that tracks sheep. Yeah, it's called Apple,” or Facebook, or whatever crappy… whatever axe someone has to grind against any particular big company. But you're talking actual sheep as in baa, smell bad, count them when going to sleep?Koz: Yes. Actual sheep.Corey: Excellent, excellent.Koz: The certs are in drones, they're in smart homes, so they're everywhere now.Corey: That is something I want to ask you about because I found that as a competition going on between your service, ACM because you won't give me the private keys for reasons that we already talked about, and Let's Encrypt. It feels like you two are both competing to not take my money, which is, you know, an odd sort of competition. You're not actually competing, you're both working for a secure internet in different ways, but I wind up getting certificates made automatically for me for all of my internal stuff using Let's Encrypt, and with publicly resolvable domain names. Why would someone want a private CA instead of an option that, okay, yeah, we're only using it internally, but there is public validity to the certificate?Koz: Sure. And just because I have to nitpick, I wouldn't say we're competing with them. I personally love Let's Encrypt; I use them at home, too. Amazon supports them financially; we give them resources. I think they're great. I think—you know, as long as you're getting certs I'm happy. The world is encrypted and I—people use private CA because fundamentally, before you get to the encryption, you need secure identity. And a certificate provides identity. And so, Let's Encrypt is great if you have a publicly accessible DNS endpoint that you can prove you own and get a certificate for and you're willing to update it within their 90-day windows. Let's use the sheep example. The sheep don't have publicly valid DNS endpoints and so—Corey: Or to be very direct with you, they also tend to not have terrific operational practices around updating their own certificates.Koz: Right. Same with drones, same with internal corporate. You may not want your DNS exposed to the internet, your internal sites. And so, you use a private certificate where you own both sides of the connection, right, where you can say—because you can put the CA in the trust store and then that gets you out of having to be compliant with the CA browser form and the web trust rules. A lot of the CA browser form dictates what a public certificate can and can't do and the rules around that, and those are built very much around the idea of a browser connecting to a client and protecting that user.Corey: And most people are not banking on a sheep.Koz: Most people are not banking on a sheep, yes. But if you have, for example, a database that requires a restart to pick up a new cert, you're not going to want to redo that every 90 days. You're probably going to be fine with a five-year certificate on that because you want to minimize your downtime. Same goes with a lot of these IoT devices, right? You may want a thousand-year cert or a hundred-year cert or cert that doesn't expire because this is a cert that happens at—that is generated at creation for the device. And it's at birth, the machine is manufactured and it gets a certificate and you want it to live for the life of that device.Or you have super-secret-project.internal.mycompany.com and you don't want a publicly visible cert for that because you're not ready to launch it, and so you'll start with a private cert. Really, my advice to customers is, if you own both pieces of the connection, you know, if you have an API that gets called by a client you own, you're almost always better off with a private certificate and managing that trust store yourself because then you are subject not to other people's rules, but the rules that fit the security model and the threat assessment you've done.Corey: For the publication system for my newsletter, when I was building it out, I wanted to use client certificates as a way of authenticating that it was me. Because I only have a small number of devices that need to talk to this thing; other people don't, so how do I submit things into my queue and manage it? And back in those ancient days, the API Gateways didn't support TLS authentication. Now, they do. I would redo it a bunch of different ways. They did support API key as an authentication mechanism, but the documentation back then was so terrible, or I was so new to this stuff, I didn't realize what it was and introduced it myself from first principles where there's a hard-coded UUID, and as long as there's the right header with that UUID, I accept it, otherwise drop it on the floor. Which… there are probably better ways to do that.Koz: Sure. Certificates are, you know, a very popular way to handle that situation because they provide that secure identity, right? You can be assured that the thing connecting to you can prove it is who they say they are. And that's a great use of a private CA.Corey: Changing gears slightly. As we record this, we are about two weeks before re:Inforce, but I will be off doing my own thing on that day. Anything interesting and exciting coming out of your group that's going to be announced, with the proviso, of course, that this will not air until after re:Inforce.Koz: Yes. So, we are going to be pre-announcing the launch of a connector for Active Directory. So, you will be able to tie your private CA instance to your Active Directory tree and use private CA to issue certificates for use by Active Directory for all of your Windows hosts for the users in that Active Directory tree.Corey: It has been many years since I touched Windows in anger, but in 2003 or so, I was a mediocre Small Business Windows Server Admin. Doesn't Active Directory have a private CA built into it by default for whenever you're creating a new directory?Koz: It does.Corey: Is that one of the FSMO roles? I'm trying to remember offhand.Koz: What's a Fimal?Corey: FSMO. F-S-M-O. There are—I forget, it's some trivia question that people love to haze each other with in Microsoft interviews. “What are the seven FSMO roles?” At least back then. And have to be moved before you decommission a domain controller or you're going to have tears before bedtime.Koz: Ah. Yeah, so Microsoft provides a certificate authority for use with Active Directory. They've had it for years and they had to provide it because back then nobody had a certificate authority, but AD needed one. The difference here is we manage it for you. And it's backed by HSMs. We ensure that the keys are kept secure. It's a serverless connection to your Active Directory tree, you don't have to run any software of ours on your hosts. We take care of all of it.And it's been the top requests from customers for years now. It's been quite [laugh] a bit of effort to build it, but we think customers are going to love it because they're going to get all the security and best practices from private CA that they're used to and they can decommission their on-prem certificate authority and not have to go through the hassle of running it.Corey: A big area where I see a lot of private CA work has been in the realm of desktops for corporate environments because when you can pass out your custom trusted root or trusted CA to all of the various nodes you have and can control them, it becomes a lot easier. I always tended to shy away from it, just because in small businesses like the one that I own, I don't want to play corporate IT guy more than I absolutely have to.Koz: Yeah. Trust or management is always a painful part of PKI. As if there weren't enough painful things in PKI. Trust store management is yet another one. Thankfully, in the large enterprises, there are good tooling out there to help you manage it for the corporate desktops and things like that.And with private CA, you can also, if you already have an offline root that is in all of your trust stores in your enterprise, you can cross-sign the route that we give you from private CA into that hierarchy. And so, then you don't have to distribute a new trust store out if you don't want to.Corey: This is a tricky release and I'm very glad I'm taking the week off it's getting announced because there are two reactions that are going to happen to any snarking I can do about this. The first is no one knows what the hell this is and doesn't have any context for the rest, and the other folks are going to be, “Yes, shut up clown. This is going to change my workflow in amazing ways. I'll deal with your nonsense later. I want to do this.” And I feel like one of those constituencies is very much your target market and the other isn't. Which is fine. No service that AWS offers—except the bill—is for every customer, but every service is for someone.Koz: That's right. We've heard from a lot of our customers, especially as they—you know, the large international ones, right, they find themselves running separate Active Directory CAs in different countries because they have different regulatory requirements and separations that they want to do. They are chomping at the bit to get this functionality because we make it so easy to run a private CA in these different regions. There's certainly going to be that segment at re:Inforce, that's just happy certificates happen in the background and they don't think anything about where they come from and this won't resonate with them, but I assure you, for every one of them, they have a colleague somewhere else in the building that is going to do a happy dance when this launches because there's a great deal of customer heavy-lifting and just sharp edges that we're taking away from them. And we'll manage it for them, and they're going to love it.[midroll 0:21:08]Corey: One thing that I have seen the industry shift to that I love is the Let's Encrypt model, where the certificate expires after 90 days. And I love that window because it is a quarter, which means yes, you can do the crappy thing and have a calendar reminder to renew the thing. It's not something you have to do every week, so you will still do it, but you're also not going to love it. It's just enough friction to inspire people to automate these things. And that I think is the real win.There's a bunch of things like Certbot, I believe the protocol is called ACME A-C-M-E, always in caps, which usually means an acronym or someone has their caps lock key pressed—which is of course cruise control for cool. But that entire idea of being able to have a back-and-forth authentication pass and renew certificates on a schedule, it's transformative.Koz: I agree. ACM, even Amazon before ACM, we've always believed that automation is the way out of a lot of this pain. As you said earlier, moving from a one-year cert to a five-year cert doesn't buy you anything other than you lose even more institutional knowledge when your cert expires. You know, I think that the move to further automation is great. I think ACME is a great first step.One of the things we've learned is that we really do need a closed loop of monitoring to go with certificate issuance. So, at Amazon, for example, every cert that we issue, we also track and the endpoints emit metrics that tell us what cert they're using. And it's not what's on disk, it's what's actually in the endpoint and what they're serving from memory. And we know because we control every cert issued within the company, every cert that's in use, and if we see a cert in use that, for example, isn't the latest one we issued, we can send an alert to the team that's running it. Or if we've issued a cert and we don't see it in use, we see the old ones still in use, we can send them an alert, they can alarm and they can see that, oh, we need to do something because our automation failed in this case.And so, I think ACME is great. I think the push Let's Encrypt did to say, “We're going to give you a free certificate, but it's going to be short-lived so you have to automate,” that's a powerful carrot and stick combination they have going, and I think for many customers Certbot's enough. But you'll see even with ACM where we manage it for our customers, we have that closed loop internally as well to make sure that the cert when we issue a new cert to our client, you know, to the partner team, that it does get picked up and it does get loaded. Because issuing you a cert isn't enough; we have to make sure that you're actually using the new certificate.Corey: I also have learned as a result of this, for example, that AWS certificate manager—Amazon Certificate Manager, the ACM, the certificate thingy that you run, that so many names, so many acronyms. It's great—but it has a limit—by default—of 2500 certificates. And I know this because I smacked into it. Why? I wasn't sitting there clicking and adding that many certificates, but I had a delightful step function pattern called ‘The Lambda invokes itself.' And you can exhaust an awful lot of resources that way because I am bad at programming. That is why for safety, I always recommend that you iterate development-wise in an account that is not production, and preferably one that belongs to someone else.Koz: [laugh]. We do have limits on cert issuance.Corey: You have limits on everything in AWS. As it should because it turns out that whatever there's not a limit, A, free database just dropped, and B, things get hammered to death. You have to harden these things. And it's one of those things that's obvious once you've operated at a certain point of scale, but until you do, it just feels arbitrary and capricious. It's one of those things where I think Amazon is still—and all the cloud companies who do this—are misunderstood.Koz: Yeah. So, in the case of the ACM limits, we look at them fairly regularly. Right now, they're high enough that most of our customers, vast majority, never come close to hitting it. And the ones that do tend to go way over.Corey: And it's been a mistake, as in my case as well. This was not a complaint, incidentally. It was like, well, I want to wind up having more waste and more ridiculous nonsense. It was not my concern.Koz: No no no, but we do, for those customers who have not mistake use cases but actual use cases where they need more, we're happy to work with their account teams and with the customer and we can up those limits.Corey: I've always found that limit increases, with remarkably few exceptions, the process is, “Explain to you what your use case is here.” And I feel like that is a screen for, first, are you doing something horrifying for which there's a better solution? And two, it almost feels like it's a bit of a customer research approach where this is fine for most customers. What are you folks doing over there and is there a use case we haven't accounted for in how we use the service?Koz: I always find we learned something when we look at the [P100 00:26:05] accounts that they use the most certificates, and how they're operating.Corey: Every time I think I've seen it all on AWS, I just talk to one more customer, and it's back to school I go.Koz: Yep. And I thank them for that education.Corey: Oh, yeah. That is the best part of working with customers and honestly being privileged enough to work with some of these things and talk to the people who are building really neat stuff. I'm just kibitzing from the sideline most of the time.Koz: Yeah.Corey: So, one last topic I want to get into before we call it a show. You and I have been talking a fair bit, out of school, for lack of a better term, around a couple of shared interests. The one more germane to this is home automation, which is always great because especially in a married situation, at least as I am and I know you are as well, there's one partner who is really into home automation and the other partner finds himself living in a haunted house.Koz: [laugh]. I knew I had won that battle when my wife was on a work trip and she was in a hotel and she was talking to me on the phone and she realized she had to get out of bed to turn the lights off because she didn't have our Alexa Good Night routine available to her to turn all the lights off and let her go to bed. And so, she is my core customer when I do the home automation stuff. And definitely make sure my use cases and my automations work for her. But yeah, I'm… I love that space.Coincidentally, it overlaps with my work life quite a bit because identity in smart home is a challenge. We're really excited about the Matter standard. For those listening who aren't sure what that is, it's a new end-all be-all smart home standard for defining devices in a protocol-independent way that lets your hubs talk to devices without needing drivers from each company to interact with them. And one of the things I love about it is every device needs a certificate to identify it. And so, private CA has been a great partner with Matter, you know, it goes well with it.In fact, we're one of the leading certificate authorities for Matter devices. Customers love the pricing and the way they can get started without talking to anybody. So yeah, I'm excited to see, you know, as a smart home junkie and as a PKI guy, I'm excited to see Matter take off. Right now I have a huge amalgamation of smart home devices at home and seeing them all go to Matter will be wonderful.Corey: Oh, it's fantastic. I am a little worried about aspects of this, though, where you have things that get access to the internet and then act as a bridge. So suddenly, like, I have a IoT subnet with some controls on it for obvious reasons and honestly, one of the things I despise the most in this world has been the rise of smart TVs because I just want you to be a big dumb screen. “Well, how are you going to watch your movies?” “With the Apple TV I've plugged into the thing. I just want you to be a screen. That's it.” So, I live a bit in fear of the day where these things find alternate ways to talk to the internet and, you know, report on what I'm watching.Koz: Yeah, I think Matter is going to help a lot with this because it's focused on local control. And so, you'll have to trust your hub, whether that's your TV or your Echo device or what have you, but they all communicate securely amongst themselves. They use certificates for identification, and they're building into Matter a robust revocation mechanism. You know, in my case at home, my TV's not connected to the internet because I use my Fire TV to talk to it, similar to your Apple TV situation. I want a device I control not my TV, doing it. I'm happy with the big dumb screen.And I think, you know, what you're going to end up doing is saying there's a device out there you'll trust maybe more than others and say, “That's what I'm going to use as my hub for my Matter devices and that's what will speak to the internet,” and otherwise my Matter devices will talk directly to my hub.Corey: Yeah, there's very much a spectrum of trust. There's the, this is a Linux distribution on a computer that I installed myself and vetted and wound up contributing to at one point on the one end of the spectrum, and the other end of the spectrum of things you trust the absolute least in this world, which are, of course, printers. And most things fall somewhere in between.Koz: Yes, right, now, it is a Wild West of rebranded white-label applications, right? You have all kinds of companies spitting out reference designs as products and white labeling the control app for it. And so, your phone starts collecting these smart home applications to control each one of these things because you buy different switches from different people. I'm looking forward to Matter collapsing that all down to having one application and one control model for all of the smart home devices.Corey: Wemo explicitly stated that they're not going to be pursuing this because it doesn't let them differentiate the experience. Read as, cash grab. I also found out that Wemo—which is, of course, a Belkin subsidiary—had a critical vulnerability in some of the light switches it offered, including the one built into the wall in this room—until a week ago—where they're not going to be releasing a patch for it because those are end-of-life. Really? Because I log into the Wemo app and the only way I would have known this has been the fact that it's been a suspiciously long time since there was a firmware update available for it. But that's it. Like, the only way I found this out was via a security advisory, at which point that got ripped out of the wall and replaced with something that isn't, you know, horrifying. But man did that bother me.Koz: Yeah. I think this is still an open issue for the smart home world.Corey: Every company wants a moat of some sort, but I don't want 15 different apps to manage this stuff. You turned me on to Home Assistant, which is an open-source, home control automation system and, on some level, the interface is very clearly built by a bunch of open-source people—good for them; they could benefit from a graphic designer or three to—or user experience person to tie it all together, but once you wrap your head around it, it works really well, where I have automations let me do different things. They even have an Apple Watch app [without its 00:32:14] complications on it. So, I can tap the thing and turn on the lights in my office to different levels if I don't want to talk to the robot that runs my house. And because my daughter has started getting very deeply absorbed into some YouTube videos from time to time, after the third time I asked her what—I call her name, I tap a different one and the internet dies to her iPad specifically, and I wait about 30 to 45 seconds, and she'll find me immediately.Koz: That's an amazing automation. I love Home Assistant. It's certainly more technical than I could give to my parents, for example, right now. I think things like Matter are going to bring a lot of that functionality to the easier-to-use hubs. And I think Home Assistant will get better over time as well.I think the only way to deal with these devices that are going to end-of-life and stop getting support is have them be local control only and so then it's your hub that keeps getting support and that's what talks to the internet. And so, you don't—you know, if there's a vulnerability in the TCP stack, for example, in your light switch, but your light switch only talks to the hub and isn't allowed to talk to anything else, how severe is that? I don't think it's so bad. Certainly, I wall off all of my IoT devices so that they don't talk to the rest of my network, but now you're getting a fairly complicated networking… mojo that listeners to your podcast I'm sure capable of, but many people aren't.Corey: I had something that did something very similar and then I had to remove a lot of those restrictions, try to diagnose a phantom issue that it appears was an unreported bug in the wireless AP when you use its second ethernet port as a bridge, where things would intermittently not be able to cross VLANs when passing through that. As in, the initial host key exchange for SSH would work and then it would stall and resets on both sides and it was a disaster. It was, what is going on here? And the answer was it was haunted. So, a small architecture change later, and the problem has not recurred. I need to reapply those restrictions.Koz: I mean, these are the kinds of things that just make me want to live in a shack in the woods, right? Like, I don't know how you manage something like that. Like, these are just pain points all over. I think over time, they'll get better, but until then, that shack in the woods with not even running water sounds pretty appealing.Corey: Yeah, at some level, having smart lights, for example, one of the best approaches that all the manufacturers I've seen have taken, it still works exactly as you would expect when you hit the light switch on the wall because that's something that you really need to make work or it turns out for those of us who don't live alone, we will not be allowed to smart home things anymore.Koz: Exactly. I don't have any smart bulbs in my house. They're all smart switches because I don't want to have to put tape over something and say, “Don't hit that switch.” And then watch one of my family members pull the tape off and hit the switch anyways.Corey: I have floor lamps with smart bulbs in them, but I wind up treating them all as one device. And I mean, I've taken the switch out from the root because it's, like, too many things to wind up slicing and dicing. But yeah, there's a scaling problem because right now a lot of this stuff—because Matter is not quite there all winds up using either Zigbee—which is fine; I have no problem with that it feels like it's becoming Matter quickly—or WiFi. And there is an upper bound to how many devices you want or can have on some fairly limited frequency.Koz: Yeah. I think this is still something that needs to be resolved. You know, I've got hundreds of devices in my house. Thankfully, most of them are not WiFi or Zigbee. But I think we're going to see this evolve over time and I'm excited for it.Corey: I was talking to someone where I was explaining that, well, how this stuff works. Like, “Well, how many devices could you possibly have on your home network?” And at the time it was about 70 or 80. And they just stared at me for the longest time. I mean, it used to be that I could name all the computers in my house. I can no longer do that.Koz: Sure. Well, I mean, every light switch ends up being a computer.Corey: And that's the weirdest thing is that it's, I'm used to computers, being a thing that requires maintenance and care and feeding and security patches and—yes, relevant to your work—an SSL certificate. It's like, so what does all of that fancy wizardry do? Well, when it receives a signal, it completes a circuit. The end. And it's, are really better off for some of these things? There are days we wonder.Koz: Well, my light bill, my electric bill, is definitely better off having these smart switches because nobody in my house seems to know how to turn a light switch off. And so, having the house do it itself helps quite a bit.Corey: To be very clear, I would skewer you if you worked on an AWS service that actually charged money for anything for what you just said about the complaining about light bills and optimizing light bills and the rest—Koz: [laugh].Corey: —but I've never had to optimize your service's certificate bill beca—after you've spun off the one thing that charges—because you can't cost optimize free, as it turns out, and I've yet to find a way to the one optimization possible where now you start paying customers money. I'm sure there's a way to do that somewhere but damned if I can find it.Koz: Well, if you find a way to optimize free, please let me know and I'll share it with all of our customers.Corey: [laugh]. Isn't that the truth? I really want to thank you for taking the time to speak with me today. If people want to learn more, where's the best place for them to find you?Koz: I can give you the standard AWS answer.Corey: Yeah, www.aws.com. Yeah.Koz: Well, I would have said koz@amazon.com. I'm always happy to talk about certs and PKI. I find myself less active on social media lately. You can find me, I guess, on Twitter as @seakoz and on Bluesky as [kozolchyk.com 00:38:03].Corey: And we will put links to all of that in the [show notes 00:38:06]. Thank you so much for being so generous with your time. I appreciate it.Koz: Always happy, Corey.Corey: Jonathan Kozolchyk, or Koz as we all call him, general manager for Certificate Services at AWS. I'm Cloud Economist Corey Quinn and this is Screaming in the Cloud. If you've enjoyed this podcast, please leave a five-star review on your podcast platform of choice, whereas if you've hated this podcast, please leave a five-star review on your podcast platform of choice along with an angry, insulting comment that then will fail to post because your podcast platform of choice has an expired security certificate.Corey: If your AWS bill keeps rising and your blood pressure is doing the same, then you need The Duckbill Group. We help companies fix their AWS bill by making it smaller and less horrifying. The Duckbill Group works for you, not AWS. We tailor recommendations to your business and we get to the point. Visit duckbillgroup.com to get started.

In this episode, Simon is joined by members of the AWS Private Certificate Authority (AWS Private CA) service team, GM Todd Cignetti and Principal Software Engineer Param Sharma, to discuss how the service has evolved since the 2018 launch. AWS Private CA is a managed private certificate authority (CA) service that you can use to create CA hierarchies and issue private X.509 certificates. Learn about how to design CA hierarchies to scale for long-term PKI needs, Kubernetes connectors, and the latest feature, short-lived certificate mode. AWS Private CA: https://bit.ly/45tt4G4 Read the short-lived certificate mode blog: https://bit.ly/45xTWVl Learn about AWS post-quantum investments: https://bit.ly/3WtYg45

We all use certificates and certificate authorities every day, so in episode 76 Scott takes a deep dive on Public Key Infrastructure (PKI) with Linda Ikechuwku of Smallstep Labs. We discuss how PKI and certificates work, revocation options, pros and cons of DIY PKI, and more.

We all use certificates and certificate authorities every day, so in episode 76 Scott takes a deep dive on Public Key Infrastructure (PKI) with Linda Ikechuwku of Smallstep Labs. We discuss how PKI and certificates work, revocation options, pros and cons of DIY PKI, and more. The post Full Stack Journey 076: Going Deep On Public Key Infrastructure appeared first on Packet Pushers.

Not much went right for the Tar Heels this weekend as Carolina Basketball went 1-2 in the PKI (4:35) and Tar Heel Football fell in double overtime to NC State (30:36)Rob Landry from Carolina Basketball joins to talk the walk-on experience, dominating life and growing up a Tar Heel (54:35)Plus: Dance Team drama (49:13), Nate Oats goes Anti-#SoClassy (1:25:31), RIP ACC/Big 10 Challenge (1:33:04) and Adam tries to solve a missing persons case on his flight back from Portland (1:38:45)See Privacy Policy at https://art19.com/privacy and California Privacy Notice at https://art19.com/privacy#do-not-sell-my-info.