Risky Business - Risky Business

Sponsored: Nucleus Security on vulnerability management trends, SLAs

Scott Kuffer talks about the interesting effect of SLAs on patch management

In this Risky Business News sponsor interview, Catalin Cimpanu talks with Nucleus Security co-founder and COO Scott Kuffer about recent trends the company has observed among customers when it came to patch management and how service level agreements (SLAs) became a sign of an organization’s security health.

Risky Biz News: Law enforcement disrupts six malware botnets

PLUS: Check Point patches zero-day; ISP loses 600,000 in data-wiping attack; Poland's secret surveillance program deemed illegal.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Srsly Risky Biz: Cyber Command is a half-ripe melon

PLUS: TikTok's influence report too little too late

In this podcast Tom Uren and Patrick Gray talk about continued discussion about the creation of a Cyber Force. It’s a discussion that won’t go away and shows there is an underlying feeling that Cyber Command could do better.

They also discuss how Scattered Spider is like Hollywood and how TikTok’s report on influence campaigns will do nothing to convince people it is not a national security risk.

Risky Business #750 -- Why Microsoft's Recall is an attacker's best friend

PLUS: Russian logistics firm stung by ransomware…

On this week’s show Patrick and Adam discuss the week’s security news, including:

  • Russian delivery company gets ransomware-wiper’d
  • A supply-chain attack targets video software used in US courts
  • Checkpoint firewalls get hacked, details as clear as mud
  • Microsoft Recall delights hackers
  • Aussie telco Optus gets told its IR report isn’t legal advice
  • Cyber insurer says you’re 5x more likely to get rekt if you have a Cisco ASA
  • And much, much more.

This week’s episode is sponsored by Kroll Cyber. Alex Cowperthwaite, Kroll’s technical director research and development for offence joins to talk about how his team attacks AI models, in ways both classic and new.

Risky Biz News: MediSecure asks for a government bailout; denied!

PLUS: US sanctions Chinese nationals behind proxy botnet; Check Point VPNs are under attack; FBI estimates Scattered Spider membership at 1K members.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Between Two Nerds: Ransomware and the state

It is just like World War I

In this edition of Between Two Nerds Tom Uren and The Grugq talk about the role of the state in tackling ransomware. They discuss why action has been slow and ineffective, and what it will take to truly change the situation.

Risky Biz News: Google throws out GlobalTrust certs

PLUS: Spyware vendor pcTattletale hacked; South Africa suspends child maintenance payments after hack; Russian IAB charged in the US.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Sponsored: Why directory services are always a dog's breakfast

SpecterOps on how the complexity or organisations results in vulnerability

In this Risky Business News sponsored interview, Tom Uren talks to Justin Kohler, VP of the Bloodhound team at SpecterOps about ‘attack paths’, the ways that malicious actors maneuver through Active Directory to elevate their privileges. They discuss how and why they arise and what you can do about them.

Srsly Risky Biz: UK to consider licensing ransomware payments

PLUS: Spreading government defences

In this podcast Tom Uren and Patrick Gray talk about a UK government proposal that would see ransomware victims seek government approval before making ransom payments.

They also talk about why governments need to be more proactive about defending democracy and why that is difficult.

Risky Business #749 -- Google answer to Microsoft's insecurity? Buy Google stuff!

Why the answer to the 365 mess isn't "just use Workspace"...

This week’s episode was recorded in front of a live audience at AusCERT’s 2024 conference. Pat and Adam talked through:

  • Google starts using security as a marketing tool against Microsoft, along with steep discounts
  • Microsoft announces a creepy desktop recording AI
  • UK govt proposes ransom payment controls
  • Arizona woman runs a laptop farm for North Korea
  • Julian Assange just keeps on with his malarky
  • And much, much more

This week’s episode is sponsored by Tines. Its CEO Eoin Hinchy joins the show to talk about how AI can be genuinely useful in automation.

Risky Biz News: DNSBomb attack is here! Pew pew pew!!!

PLUS: Rockwell tells customers to disconnect ICS gear from the internet; Linguistic Lumberjack vulnerability impacts most cloud providers; Incognito Market admin arrested.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Between Three Nerds: The strategic culture of Russian intelligence

How the KGB's culture lives on

In this edition of Between Three Nerds Tom Uren and The Grugq talk to Elena Grossfeld about the strategic culture of Russian intelligence organisations.

In the discussion we refer to Elena’s paper on Russia’s declining satellite reconnaissance capability and she talks about ‘lustration’, the removal of public officials who are associated with a tainted political regime.

Elena is researching Russian and Soviet intelligence culture at Kings College London and is on X @kloosha.

Risky Biz News: Germany sues Microsoft for details on past hack

PLUS: VirusTotal releases a new YARA version rewritten in Rust; SEC adopts stricter data breach notification rules; first major deepfake hack incident confirmed.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Sponsored: Proofpoint on the current threat actor landscape

Proofpoint senior threat intelligence analyst Selena Larson talks about the new baddies.

In this Risky Business News sponsor interview, Catalin Cimpanu talks with Proofpoint senior threat intelligence analyst Selena Larson about the latest changes in the threat actor landscape in the aftermath of several law enforcement takedowns and Microsoft tech stack changes.

Risky Biz News: Feds seize BreachForums again

PLUS: Microsoft to require MFA for all Azure accounts; US arrests woman for running laptops for DPRK IT workers; major hack at Australian healthcare org.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Wide World of Cyber: Krebs and Stamos on How AI Will Change Cybersecurity

The broader geopolitical implications of the AI boom are serious, too...

In this podcast SentinelOne’s Chief Trust officer Alex Stamos and its Chief Intelligence and Public Policy Officer Chris Krebs join Patrick Gray to talk all about AI.

It’s been a year and a half since ChatGPT landed and freaked everyone out. Since then, AI has really entrenched itself as the next big thing. It’s popping up everywhere, and the use cases for cybersecurity are starting to come into focus.

Threat actors and defenders are using this stuff already, but it’s early days and as you’ll hear, things are really going to change, and fast.

Srsly Risky Biz: The proliferation of spyware in Southeast Asia

PLUS: When cybersecurity regulation punishes the weak

In this podcast Tom Uren and Patrick Gray talk about Amnesty International’s research into Indonesia’s use of spyware implicated in human rights abuses.

They also talk about proposed regulation that would dock payments to US hospitals that don’t meet minimum cyber security standards and why the idea needs some tweaking.

Risky Business #748 -- New cyber rules for US healthcare are coming

PLUS: The Signal vs Telegram spat is cybersecurity's horse paste controversy...

This week Patrick Gray and Adam Boileau along special guest Lina Lau discuss the week’s news, including:

  • The ongoing Ascension healthcare disruption, and
  • Whether its reasonable for healthcare orgs to be pushing back
  • Platforming cybercriminals for interviews
  • Own the libs by… not using E2EE messaging?
  • CISA’s secure by design, we want to believe!
  • The $64billion scale of indusrialised fraud
  • And much, much more.

This week’s sponsor is network discovery specialist, Run Zero. Director of research Rob King joins to talk about the weird and wonderful delights in their new Research Report.