Today’s show is Michael interviewing Kevin Riggins. Kevin is an Enterprise Security Architect for a Fortune 500 financial services company. Kevin and Michael have some great conversation about Kevin’s job, what he is doing at RSA, where he blogs, the book he coauthored, etc. (look below in the show notes for links to everything).

Then a fun discussion starts about cloud, risk, mobility, risk in the cloud, risk in mobility, risk of mobility integrated with the cloud, and so on. Good stuff all around.

Here’s some links to stuff about Kevin and other stuff we talked about in the show.

  • Management Team Member for the Society of Information Risk Analysis – link
  • Coauthor on The Cloud Security Rules – link
  • Kevin blogs at Infosecramblings – link
  • Twitter pages – link and link and link
  •  

    Thanks go to Jeremiah Grossman for sitting down with Michael for some great discussion. Jeremiah is the CTO at Whitehat Security and a very well known figure in the InfoSec industry. Jeremiah and Michael talk about Hawaii, sharks, security philosophy, RSA, stage fright, Jeremiah’s TED talk (not published as of the posting of this entry), and the age of the InfoSec industry and whether young folks are coming into the fold.

    You can find Jeremiah at Whitehat (link above) and his blog, and you can follow him and on Twitter as well. Jeremiah will be giving a talk and participating on panel at RSA as well, so be sure to attend those if you are going to the RSA Conference 2012.

     

    Wow! 6 Months…and 2 job changes later, we are finally back to recording! YEAH!….Here the latest show from our intrepid hosts.

    Show Notes:

    InfoSec News Update –

    • The Hacker News Hacking Awards : Best of Year 2011 – Link Here
    • Japan’s Anti-Virus Virus – Link Here
    • Nginx (pronunciation: “engine-ex”) becomes #2 web server
    • Saudi hackers break into Israeli site – Link Here
    • 3 Surefire Ways to Tick Off an Auditor – Link Here
    • OWASP AJAX Crawling Tool – Link1 / Link2

    Discussion Topic – 2012 Breach Report

    1. Care2 Discloses Breach; Company Has Nearly 18 Million Members – Link Here
    2. AntiSec hit California and NY Law Enforcement Sites – Link Here
    3. Anonymous Nabs 50,000 Credit Card Numbers From Security Think Tank – Link Here

    Music Notes:Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour Dates:

    1. Jan 6 – Dallas – Curtain Club
    2. Jan 27 – Dallas – Trees
    3. Jan 28 – Dallas – Trees
    4. Mar 2 – Dallas – Curtain Club – 7th Album CD Release Party
    5. Mar 3 – Houston – BFE Rock Club
    6. Mar 24 – Fort Worth – The Rail Club
    7. May 5 – Dallas – Renos Chop Shop

    Intro – RivetHead – The 13th Step”

    News Bed – RivetHead - “Beautiful Disaster”

    Discussion Bed – RivetHead - “Difference”

    Outro – RivetHead – “Zero Gravity”

    Link to MP3

     

    Today we have an interview for you. Michael had a great time sitting down with four gentlemen (they might not all agree with that term) from SpiderLabs over at Trustwave. The aforementioned SpiderLabs folks were Nicholas Percoco (@c7five), Steve Ocepek (@nosteve), Matt Jakubowski (@jaku), and Zack Fasel (@zfasel) – those are Twitter aliases for you newbs out there.

    They went over their respective histories, talked about SpiderLabs and their leetness, discussed a few talks that they are doing at DEFCON, talked about their party at DEFCON that will be held in a super-secret location, and went through about 50 SpiderLabs insider jokes.

    Michael is also pretty sure someone (Zack) was enjoying adult beverages (Zack) during the recording (Zack), but he might be wrong…

    Enjoy the show. And once again, thanks to Rivethead for the tracks. Go out to their website to see the latest on them, where they are playing, and all their news.

     

    A lot of discussion in this episode. And what is more funny is Dan actually cuts Jim off on a subject. Yes, you heard it right. The famous “Web Security Minute Turned to 20 Minutes” Dan makes Jim stop talking. I guess the end of the world IS here!

    Oh, and Dan leads us into the Land of Many Links with his Clickjacking story.

    Show Notes:

    InfoSec News Update -

    • HouSecCon 2011 update – Registration is open – Link Here
    • PCI Physical badging Gap – Link Here
    • Using Mario against us (evil) – Link Here
    • FUD article of the day – Half of lost/stolen mobile device have sensitive info on them – Link Here
    • Defining appropriate Cyber Attack response, A.K.A Eat my cruise missile you Commie, Pinko hacker! – Link Here
    • Clickjacking, Cookiejacking oh my! – Link 1 / Link 2 / Link 3 / Link 4
    • Can you have too much security? – Link Here

    Geek Toys -

    Discussion Topic – Five Infamous Database Breaches So Far In 2011 – Link Here

    Music Notes:

    Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour dates:

    • July 9 – with Powderburn, Earthrot, and more – Tomcats West in Fort Worth, TX
    • July 24 – with Creeper, Phantom X, and more – Oriley’s in Dallas, TX

    Intro – RivetHead – “Stirring It Up Again”
    News Bed – RivetHead - “Beautiful Disaster”
    Discussion Bed – RivetHead - “Difference”
    Outro – RivetHead – “Zero Gravity”

    Link to MP3

     

    I am tired of making excuses about us being late, so here is friggin’ episode #05-2011. Have fun!

    Show Notes:

    InfoSec News Update -

    Discussion Topic – Scoping too small…

    Music Notes:

    Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour dates:

    • July 9 – with Powderburn, Earthrot, and more – Tomcats West in Fort Worth, TX
    • July 24 – with Creeper, Phantom X, and more – Oriley’s in Dallas, TX

    Intro – RivetHead – “Stirring It Up Again”
    News Bed – RivetHead - “Beautiful Disaster”
    Discussion Bed – RivetHead - “Difference”
    Outro – RivetHead – “Zero Gravity”

    Link to MP3

     

    Hey, all three of us are here, and on schedule…. somebody check the temp outside :)

    Show Notes:

    InfoSec News Update -

     

    • TexSecConTriangle.com coming soon – HouSecCon, BSidesDFW, and LasCon
    • Gonzales Update – Link Here
    • Dropbox Pwnage -Link Here
    • TX exposes 3.5 Mill records – Link Here
    • Yet another Security Company Fail – Link Here
    • IPhone keylogger – Link Here
    • Law Firms Under Siege – Link Here

    Discussion Topic – Reading the Fine Print in Cloud Computing – Link Here

    Music Notes:

    Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour dates:

    • Apr 20, 2011 – Sevendust, RIVETHEAD and TBA – Trees – Dallas, TX
    • May 7, 2011 – Powderburn and RIVETHEAD – BFE Rock Club – Houston, TX
    • Jun 4, 2011 – RIVETHEAD, The Razorblade Dolls, Horror Cult and more – The Rail – Fort Worth, TX
    • Jul 9, 2011 – RIVETHEAD, Powderburn, Earthrot and more – Tomcats West – Fort Worth, TX

    Intro – RivetHead – “Stirring It Up Again”
    News Bed – RivetHead - “Beautiful Disaster”
    Discussion Bed – RivetHead - “Difference”
    Outro – RivetHead – “Zero Gravity”

    Link to MP3


     

    So it took a bit longer this time due to scheduling, and bodily harm on Michael’s part… but we finally got another episode recorded. Enjoy.

    Show Notes:

    InfoSec News Update -

    Discussion Topic – How Detailed is Your DR Plan?

    Music Notes:

    Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour dates:

    • Apr 20, 2011 – Sevendust, RIVETHEAD and TBA – Trees – Dallas, TX
    • May 7, 2011 – Powderburn and RIVETHEAD – BFE Rock Club – Houston, TX
    • Jun 4, 2011 – RIVETHEAD, The Razorblade Dolls, Horror Cult and more – The Rail – Fort Worth, TX
    • Jul 9, 2011 – RIVETHEAD, Powderburn, Earthrot and more – Tomcats West – Fort Worth, TX

    Intro – RivetHead – “Stirring It Up Again”

    News Bed – RivetHead – “Beautiful Disaster”
    Discussion Bed – RivetHead - “Difference”
    Outro – RivetHead – “Zero Gravity”


    Link to MP3


     

    We have a little bit of innuendo humor on this episode, and we all break into some hysterics (it’s all in the geek toys section, so fast forward if you want to hear all that). Around that is some information and opinion on InfoSec stuff. We figured we would throw that in there because of the name of the podcast, but whatever…

    Show Notes:

    InfoSec News Update -

    • HouSecCon 2011 Call for Papers – Link Here
    • Busting DLP Myths or Playing with Hype? Link Here
    • Google collecting kid’s info (including last 4 of SSN) for Doodling contest – Link Here
    • Smartphone security threats overdramatized – Link Here
    • 7 Deadly Sins – Link Here
    • Another certification debate – Link Here
    • Abusing HTTP Status Codes to Expose Private Information – Link Here

    Geek Toys –

    Discussion Topic – Saying No to Bad Patents – Link 1 / Link 2 / Link 3

    Music Notes:

    Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour dates:

    • Feb 26th – in Carlsbad NM
    • March 19 – The American Airlines Center at the Dallas Stars Hockey Game

    Intro – RivetHead – “Stirring It Up Again”
    News Bed – RivetHead – “Beautiful Disaster”
    Discussion Bed – RivetHead - “Difference”
    Outro – RivetHead – “Zero Gravity”

    Link to file

     

    Thomas Jefferson said, “Delay is preferable to error.” Martin Luther said, “Who waits until circumstances completely favor his undertaking will never accomplish anything.” So depending on which quote you like, we either took a long time to record a new episode so we would do it right, or we are just a bunch of slackers. I prefer the former, but I am biased…

    In either case, we’re back, and in the immortal words of Rivethead, we’re “Stirring It Up Again” (you’ll read about Riverthead below and hear about them in the podcast).  Jim, Dan, and I got together on a cold and stormy night (at least in Houston and Denver) to talk about all things InfoSec.  Show notes are below.  Oh, and yes, we are going with a new theme for numbering our episodes.  I think it takes away the pressure a little myself since I don’t have to worry about huge numbers for episodes.  Of course, I’ll have to count now, which sucks (thanks Jim).

    Show Notes:

    InfoSec News Update -

    • Study shows non-compliance more expensive than compliance (study was sponsored by Tripwire) – Article Link / Report Link
    • Security Fail – When Trusted IT members go bad!! – Link Here
    • “It’s a CIO’s worst nightmare: You get a call from the Business Software Alliance (BSA), saying that some of the Microsoft software your company uses might be pirated.

      You investigate and find that not only is your software illegal, it was sold to you by a company secretly owned and operated by none other than your own IT systems administrator,
      a trusted employee for seven years. When you start digging into the admin’s activities, you find a for-pay porn Web site he’s been running on one of your corporate servers.
      Then you find that he’s downloaded 400 customer credit card numbers from your e-commerce server.

      And here’s the worst part: He’s the only one with the administrative passwords.”

    • Looking back at old security news – have we made progress?? – Link Here (Registration required for full article)
    • A SLOW Death! – Link Here
    • Egypt gets Internet connection back – Link Here
    • Ever Cookie’s Anyone? – Link Here

    Discussion Topic #1 – CSRF and Clickjacking – Link Here

    Music Notes:

    Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour dates:

  • Feb 19th – Playing Curtain Club Dallas, TX
  • Feb 26th -  in Carlsbad, NM
  • March 19th – American Airlines Center at a Dallas Stars Hockey game
  • Intro – RivetHead – “Stirring It Up Again”
  • Outro – RivetHead – “Zero Gravity”
  • Link to MP3