8th Layer Insights

By Perry Carpenter | CyberWire Inc.

Listen to a podcast, please open Podcast Republic app. Available on Google Play Store.


Category: Technology

Open in Apple Podcasts


Open RSS feed


Open Website


Rate for this podcast

Subscribers: 268
Reviews: 1

Muxlisaxon
 Sep 27, 2022
umarxonova

Description

Get ready for a deep dive into what cybersecurity professionals often refer to as the "8th Layer" of security: HUMANS. Welcome to 8th Layer Insights (8Li). This podcast is a multidisciplinary exploration into how the complexities of human nature affect security and risk. Author, security researcher, and behavior science enthusiast Perry Carpenter taps experts for their insights and illumination. Topics include cybersecurity, psychology, behavior science, communication, leadership, and more.

Episode Date
Spycraft: A Behind the Curtain Look into the Intelligence Community
3100
There is something about a good spy story that seems to really resonate with people in the cybersecurity world. We love watching the moves and the counter moves, and the sneaking around, and the social engineering, and hacking, and all of the gadgets and toys, and car chases, and fights and double crosses and triple crosses. Yeah, you get the point.  But how much of that is real and how much can be chalked up to an author's creative license? And what's life and work like for real people in the intelligence industry? This episode features two guests: ex-CIA agent Peter Warmka and Andrew Hammond, historian and curator at the International Spy Museum. Guests: Peter Warmka (LinkedIn) (Twitter) (Website) Andrew Hammond (LinkedIn) (Twitter) (Website) Books and References: Confessions of a CIA Spy: The Art of Human Hacking, by Peter Warmka The CIA Guy & CIA Spy Podcast, Peter Warmka and Robert Siciliano Peter Warmka Videos International Spy Museum website SpyCast Podcast, hosted by Andrew Hammond INTEL.gov The Evolution of Espionage in America, INTEL.org Perry's Books Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: perry [at] 8thLayerMedia [dot] com
Nov 15, 2022
8th Layer Insights and the Quest for Security Culture
4182
For this week, we are revisiting a previous episode that first aired as Season 1 Episode 10. In this episode, we discuss the concept of security culture -- specifically, the difficulty that security leaders have in defining what a security culture actually is. Luckily, we can draw on learnings from organizational culture management and culture transformation experts. Guests for this episode include, David Sturt, Executive Vice President of the O.C. Tanner Institute, author of Great Work: How to Make a Difference People Love and Appreciate: Celebrating People, Inspiring Greatness., Dr. Jessica Barker (co-CEO and Co-Founder, Socio-Technical Lead at Cygenta; author of Confident Cyber Security and co-author of Cybersecurity ABCs), Kai Roer, Chief Research Officer at KnowBe4, creator of the Security Culture Framework, author of Build a Security Culture, and Michael Leckie, founding partner at Silverback Partners, LLC and author of The Heart of Transformation: Build the Human Capabilities that Change Organizations for Good. Guests: David Sturt Dr. Jessica Barker Kai Roer Michael Leckie References, Resources & Books: Security ABCs Part 1: Make Awareness Transformational, 8Li Season 1, Episode 9 4 Ways to Build a Thoughtful Security Culture, by Perry Carpenter 7 Tips for Building a Strong Security Culture, by Perry Carpenter Appreciate: Celebrating People, Inspiring Greatness, by David Sturt Build a Security Culture, by Kai Roer Confident Cyber Security: How to Get Started in Cyber Security and Futureproof Your Career, by Jessica Barker Culture Rules! The 10 Core Principles of Corporate Culture, by John R. Childress Cybersecurity ABCs: Delivering awareness, behaviours and culture change, by Jessica Barker, Adrian Davis, and Bruce Hallas Great Work: How to Make a Difference People Love, by David Sturt The Heart of Transformation: Build the Human Capabilities that Change Organizations for Good,, by Michael Leckie The Importance Of A Strong Security Culture And How To Build One, by Perry Carpenter Perry Carpenter's (ISC)2 Info Security Professional Journal 4 episode series on Security Awareness (Episode 1, Episode 2, Episode 3, Episode 4) Security Culture and Credential Sharing, KnowBe4 Research Security Culture Report 2021: A Global Security Culture Perspective During a Pandemic, KnowBe4 Research Seven Dimensions of Security Culture, KnowBe4 Research Perry's Books Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: perry [at] 8thLayerMedia [dot] com
Nov 01, 2022
Social Engineering and Breaking into Stuff with Jenny Radcliffe
2181
On this episode, Perry sits down with Jenny Radcliffe (a.k.a. The People Hacker). Jenny is a well-known speaker, podcaster, professional social engineer, and physical penetration tester… in other words, she’s a social engineer who specializes not only in tricking people into doing things they shouldn’t do… but she also specializes getting into places she shouldn’t be and finding things she shouldn’t be able to find. Her job is to embody the criminal mindset and use the skills of a criminal to find the vulnerabilities that a criminal would find. In this interview, Jenny talks shop about her path to becoming a full time social engineer, the realities of penetration testing, inherent vulnerabilities in buildings and humans, and how to continuously improve at anything. Guests: Jenny Radcliffe (LinkedIn) (Twitter) (Website) Books and References: Bruce Schneier blog about the Security Mindset Video -- Jenny Radcliffe: How I Fooled A £2mil Security System Jenny's interview on the Jordan Harbinger Show Jenny's interview on Darknet Diaries Jenny's interview on the Security Mastermind's Podcast The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick Harvard Business Review article on the Principles of Persuasion A blog series Perry did on Deception (Part 1), (Part 2). Perry's Books Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: perry [at] 8thLayerMedia [dot] com
Oct 18, 2022
Open Source Intelligence (OSINT): The Data We Leak
2848
Over the past few years, there's been a lot of talk about the value of understanding Open Source Intelligence (OSINT). But, even with so much talk, relatively few cybersecurity professionals have had the time to take a deep dive into the topic. In this episode, Perry sits down with social engineer, OSINT investigator, and member of the OSINT Curious project, Christina Lekati to get an overview of the value of OSINT as well as some basic techniques. After that, we hear from Chris Kirsch (co-founder and CEO of runZero). Chris is a former black badge winner at DEF CON's social engineering competition and served as a judge in the most recent competition. He recently released an interesting report analyzing the top OSINT sources and vishing (voice phishing via phone) pretexts from that competition. Guests: Christina Lekati (LinkedIn) (Twitter) Chris Kirsch (LinkedIn) (Twitter) Books and References: Top OSINT sources and vishing pretexts from DEF CON’s social engineering competition, research by Chris Kirsch referenced in this episode YouTube video by Christina Lekati: Protecting High-Value Individuals: An OSINT Workflow YouTube video: DEF CON 27 Recon Village presentation by Chris Kirsch: Using OSINT for Competitive Intelligence YouTube Playlist from the 2022 SANS OSINT Summit YouTube video by The Cyber Mentor: Learn OSINT in 4.5 Hours The OSINT Curious project DEFCON Social Engineering Community 15 top open-source intelligence tools, CSO Online Top 25 OSINT Tools for Penetration Testing, SecurityTrails WebMii.com Hunter.io Wigle.net Lockheed Martin Cyber Kill-Chain: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html Threat Modeling: Designing for Security by Adam Shostack What is Threat Modeling: https://securityintelligence.com/posts/what-is-threat-modeling-and-how-does-it-impact-application-security/ 12 Methods of threat Modeling: https://insights.sei.cmu.edu/blog/threat-modeling-12-available-methods/ The Art of Attack: Attacker Mindset for Security Professionals by Maxie Reynolds Perry's Books Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: perry [at] 8thLayerMedia [dot] com
Oct 04, 2022
The Secrets to Consistently Creating Great Content
2724
In this episode, Perry talks about the value of storytelling and provides 7 tips for anyone who faces the fear associated with staring at a blank screen, wondering how they can begin to create fresh content. This is adapted from a presentation Perry recently gave at the 2022 SANS Security Awareness Summit. Books & Resources: Overview of "The Iron Triangle" Visual Summary of Perry's SANS Security Awareness Summit presentation YouTube Video: You are not a storyteller - Stefan Sagmeister @ FITC Security is Alive: 8th Layer Insights, Season 2, episode 6 Creativity for Non Creatives: 8th Layer Insights, Season 2, episode 10 Igniting and Sustaining Creativity: 8th Layer Insights, Season 2, episode 1 Unleashing Trojan Horses for the Mind: 8th Layer Insights, Season 1, episode 1 Steal Like an Artist: 10 Things Nobody Told You About Being Creative, by Austin Kleon Show Your Work: 10 Ways to Share Your Creativity and Get Discovered,, by Austin Kleon MasterClass -- Margaret Atwood Teaches Creative Writing "Everything is Alive" Podcast Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: perry [at] 8thLayerMedia [dot] com
Sep 20, 2022
If It's Smart, It's Vulnerable: a Conversation with Mikko Hyppönen
2962
In this episode, Perry sits down with Mikko Hyppönen for a wide ranging discussion about the history, current state, and future of cybersecurity. We also discuss Mikko's new book, the title of which is derived from Hyppönen's Law: If It's Smart, It's Vulnerable. Guest: Mikko Hyppönen (LinkedIn) (Twitter) (Web) Books & Resources: If It's Smart, It's Vulnerable, by Mikko Hyppönen Mikko's TED Talks Daemon, by Daniel Suarez Internet of Things and data placement, by Dell Technologies Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: perry [at] 8thLayerMedia [dot] com
Sep 06, 2022
Finding Your Path: Mid-Career Moves into Cybersecurity
2730
This is a follow-up to Season 2, episode 4 –Bridging the Cyber Skills Gap. Many listeners contacted me saying that they loved the episode, but wished that I’d put more focus on people trying to find a career in cybersecurity later in life. So, consider this episode a Bridging the Cyber Skills Gap Part 2. We’ll hear the stories of several people who’ve come to cybersecurity a bit later in life. This episode features interviews with Alethe Denis, Tracy Z. Maleeff (a.k.a. InfoSec Sherpa), Phillip Wylie, Lisa Plaggemier, Naomi Buckwalter, and Alyssa Miller. Guests: Alethe Denis (LinkedIn) (Twitter) (LinkTree) Tracy Z. Maleeff (a.k.a. InfoSec Sherpa) (LinkedIn) (Twitter) Phillip Wylie (LinkedIn) (Twitter) (Medium) Lisa Plaggemier (LinkedIn) (Twitter) Naomi Buckwalter (LinkedIn) Alyssa Miller (LinkedIn) (Twitter) (Website) Books & Resources: The Cybersecurity Career Guide, by Alyssa Miller The Pentester BluePrint: Starting a Career as an Ethical Hacker, by Phillip Wylie The Hacker Factory Podcast | With Phillip Wylie Building the Next Generation of Cybersecurity Professionals, LinkedIn Learning course from Naomi Buckwalter 8Li: Fun and Games: Lock Picking, Capture the Flag Contests, Simulations, and More How to Break Into Cybersecurity, article by Katlyn Gallo Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: perry [at] 8thLayerMedia [dot] com
Aug 23, 2022
Cyber Mindfulness
2839
You've probably been hearing the term 'mindfulness' a lot these days. And for good reason. We humans seem to be busier and more stressed out than ever before, and mindfulness practices seem to offer positive benefit. But how does mindfulness intersect with cybersecurity? What practices can we learn and promote to decrease human risk in our organizations and live safer digital lives? In this episode, we explore the topic of cyber mindfulness. And to do so, we'll be hearing from Anna Collard, Michael Davis, and Yvonne and Jasmine Eskenzi. Guests: Anna Collard (LinkedIn) (Twitter) (Company Site) Michael Davis (LinkedIn) (Company Site) Yvonne Eskenzi (LinkedIn) (Twitter) (Company Site) Jasmine Eskenzi (LinkedIn) (Twitter) (Company Site) Books & Resources: The Zensory App Research Paper: The current state of mind: A systematic review of the relationship between mindfulness and mind-wandering Research Paper: Training to Mitigate Phishing Attacks Using Mindfulness Techniques Research Paper: Understand the mistakes that compromise your company's security University of Dayton's Cyber Mindful program overview The Human Firewall: 3 Mindfulness Techniques Your Team Can Use to Prevent Phishing Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: perry [at] 8thLayerMedia [dot] com
Aug 09, 2022
Lockpicking, Physical Penetration Testing, and More with Deviant Ollam
1598
On this bonus episode, Perry sits down with physical penetration tester, lock picking guru, and Board Member of The Open Organization of Lockpickers (TOOOL), Deviant Ollam. They discuss lockpicking, physical penetration testing, locksport, and the ethics of teaching these skills. Guest: Deviant Ollam (Twitter) (YouTube) (Website) Books & Resources: 8th Layer Insights S2E8: Fun and Games: Lock Picking, Capture the Flag Contests, Simulations, and More Lockpicking Resources from Deviant Ollam Keys to the Kingdom: Impressioning, Privilege Escalation, Bumping, and Other Key-Based Attacks Against Physical Locks, by Deviant Ollam. (Amazon affiliate link) Practical Lock Picking: A Physical Penetration Tester's Training Guide, by Deviant Ollam. (Amazon affiliate link) TOOOL US -- The Open Organization of Lockpickers TOOOL US instructional videos on YouTube The Official TOOOL Slides The Lockpicking Lawyer on YouTube Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter (Amazon affiliate link) The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer (Amazon affiliate link) Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: perry [at] 8thLayerMedia [dot] com
Jun 22, 2022
The Lazarus Heist: Investigative Journalism, Podcasting, and North Korean Hacking (with Geoff White)
2693
On this bonus episode, Perry sits down with investigative journalist, speaker, podcaster, and author, Geoff White to talk about his path into investigative journalism, podcasting, and his new book, "The Lazarus Heist: From Hollywood to High Finance: Inside North Korea's Global Cyber War." Guest: Geoff White (LinkedIn) (Twitter) (Website) Books & Podcasts: Lazarus Heist Book Lazarus Heist Podcast Crime Dot Com: From Viruses to Vote Rigging, How Hacking Went Global Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter (Amazon affiliate link) The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer (Amazon affiliate link) Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: perry [at] 8thLayerMedia [dot] com
Jun 07, 2022
An Announcement, a Request, and How You Can Win Some $$$
297
Please take the listener survey--->>> https://www.surveymonkey.com/r/8LI_Survey <<<--- One of the things that defines 8th Layer Insights is the amount of writing, editing, and production that’s involved. Each episode generally takes about 30 hours of work to complete. And, since this is a personal project, that equates to quite a few late nights and weekends. It can be exhausting… but it’s totally worth it.  YOU make it worth it. One of my main goals is ensuring that I’m doing everything possible to make this show sustainable AND continuing to improve and to never sacrifice quality. So – with that being said – I’ll let you in on how I’m planning to do it. Just a couple weeks ago, I created a company called 8th Layer Media and have brought on a brilliant partner – his name is Mason Amadeus. Mason will serve as a co-Creative Director and Production Manager. (like Carl, but more competent).  Don’t worry – Carl will still be around in season 3 and beyond. It’s hard to unseat Carl. But Mason will play a big part in increasing my capacity. Here’s where you can help: we need your input on what’s working with the show and what can be improved. We want your honest, unfiltered feedback so that we can make a show that isn’t just good – it’s great… consistently great. We also want to get information on how you first found out about 8th Layer Insights, what topics you want the show to explore and more. We even want to know if you have better ideas for the name of the show. …Seriously, if you submit an alternate show name, and we decide to adopt that name, you’ll win a $300 Amazon gift card. There will be other prizes as well. If you’re ready to help shape the future of 8th Layer Insights, take the survey: https://www.surveymonkey.com/r/8LI_Survey Survey closes Friday, June 3, 2022. Perry's Books: Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter (Amazon affiliate link) The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer (Amazon affiliate link) Wondering who Mason is? Here are a few links: Twitter (@itsMasonAmadeus) Website (https://masonamadeus.com/) Podcast (PodCube) Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerMedia [dot] com
May 17, 2022
An Interview with a Password
805
If you could interview a password, what questions would you ask? Today, May 5th, 2022 is World Password Day. World Password Day was first established in 2013 and is celebrated each year on the 1st Thursday in May. To celebrate, I thought it would be fun to share an excerpt of a previous episode ("Security is Alive") where I interviewed multiple security-related objects. This clip is my interview with Dave the Password. Stick around after the interview for a few password-related tips and best practices!
May 05, 2022
Creativity for Non-Creatives
4362
Creativity can be a scary topic for technologists. Most of us haven't been trained in the art and science of creativity and so they either feel out of their depth when called on to create content. But it doesn't have to be that way. In this episode, Perry sits down with New York Times bestselling author, Michelle Richmond, Audible bestselling author Rob Dircks, and two critically acclaimed cybersecurity podcasters, Ran Levi (creator and host of the Malicious Life podcast) and David Spark (creator and host of the CISO Series podcast) to discuss creativity, how to create relatable content, and how to communicate technology-related content in clear and compelling ways. Guests: Ran Levi (LinkedIn) (Website) David Spark (LinkedIn) (Website) Michelle Richmond (LinkedIn) (Website) (Amazon Page) Rob Dircks (LinkedIn) (Website) (Amazon Page) Books and Resources: 8Li Season 1, Episode 1: Unleashing Trojan Horses for the Mind 8Li Season 2, Episode 1: Igniting and Sustaining Creativity 8Li Season 2, Episode 2: You're Listening to "The Dark Stream" 8Li Season 2, Episode 3: Technology & the Law of Unintended Consequences 8Li Season 2, Episode 6: Security is Alive "Malicious Life" Podcast, Ran Levi "CISO Series" Podcast, David Spark How do you explain virtualization to your mom? -- David Spark video "Everything is Alive" Podcast "Writing Excuses" Podcast The Wonder Test: A Novel, by Michelle Richmond (Amazon affiliate link) The Marriage Pact: A Novel, by Michelle Richmond (Amazon affiliate link) Where the Hell is Tesla? A Novel, by Rob Dircks (Amazon affiliate link) You're Going to Mars (An Audible Original), by Rob Dircks (Amazon affiliate link) Story: Substance, Structure, Style and the Principles of Screenwriting, by Robert McKee (Amazon affiliate link) HBR Guide to Persuasive Presentations (HBR Guide Series), by Nancy Duarte (Amazon affiliate link) Alchemy: The Dark Art and Curious Science of Creating Magic in Brands, Business, and Life, by Roy Sutherland (Amazon affiliate link) How Creativity Rules the World: The Art and Business of Turning Your Ideas into Gold, by Maria Brito (Amazon affiliate link) On Writing: A Memoir of the Craft, by Stephen King (Amazon affiliate link) You Are an Artist: Assignments to Spark Creation, by Sarah Urist Green Ticktime Pomodoro Timer (Amazon affiliate link) Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter (Amazon affiliate link) The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer (Amazon affiliate link) Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerMedia [dot] com
May 03, 2022
The Next Evolution of Security Awareness
3020
"Security Awareness" is a slippery topic for a lot of people. It's a well known phrase -- and, let's face it, it's a phrase that can be very misleading. In this episode, Perry sits down with Dr. Jessica Barker (author and co-CEO at Cygenta), Cassie Clark (Security Awareness Lead Engineer at Brex), John Scott (Head of Security Education at Bank of England), and Lance Spitzner (Director, SANS Institute: Founder, Honeynet Project) to discuss what is currently being done well and, more importantly, where it needs to grow over the next few years. Spoiler alert: it's all about managing human risk. Guests: Dr. Jessica Barker (LinkedIn) (Twitter) Cassie Clark (LinkedIn) (Twitter) John Scott (LinkedIn) (Twitter) Lance Spitzner (LinkedIn) (Twitter) Books and Resources: 8Li S1 E9: Security ABCs Part 1: Make Awareness Transformational 8Li S1 E10: Security ABCs Part 2: 8th Layer Insights and the Quest for Security Culture Cybersecurity ABCs: Delivering awareness, behaviours and culture change by Jessica Barker, Adrian Davis, Bruce Hallas, & Ciarán Mc Mahon A Data-Driven Computer Defense: A Way to Improve Any Computer Defense by Roger A. Grimes Security Awareness Program Builder: Practical guidelines for building your Information Security Awareness Program & prep guide for the Security Awareness and Culture Professional (SACP)™ by Mark Majewski People-Centric Security: Transforming Your Enterprise Security Culture by Lance Hayden Start with Why: How Great Leaders Inspire Everyone to Take Action by Simon Sinek (Amazon affiliate link) Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter (Amazon affiliate link) The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer (Amazon affiliate link) Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com
Apr 19, 2022
Why Are We So Bad At Risk?
3227
Risk is a funny thing – our minds are constantly looking for risk, scanning our environments and our available choices. And sometimes we do a great job at anticipating and avoiding risky situations. But that doesn’t mean that we are universally good at dealing with risk. In fact, we can be downright appalling at considering and avoiding risk. In this episode, we explore the concept of risk, why we're so bad at understanding it, and the steps we can take to improve. Perry speaks with four risk experts who will help us understand the ups and downs of how we evaluate risk. We’ll touch on everything from Black Swans to Grey Rhinos to risk frameworks, risk equations, inbuilt risk in the design of computing interfaces, and more. Featuring Michele Wucker (author of The Grey Rhino and You Are What You Risk), Christian Hunt (Founder of Human Risk), Dr. Arun Vishwanath (Founder and Chief Technology Officer of Avant Research Group), and Matt Stamper (Chief Information Security Officer and Executive Advisor at EVOTEK and co-author of the CISO Desk Reference Guides vol1 & vol2). Original release date: Aug 31, 2021. Guests: Michele Wucker Christian Hunt Arun Vishwanath Matt Stamper Resources & Books: Black Swan Theory Grey Rhino Events Various Risk Equations Risk Perception Equation, Freakonomics 20 Cognitive Biases That Affect Risk Decision Making, SafetyRisk.net Factor Analysis of Information Risk (FAIR) Framework The Gray Rhino: How to Recognize and Act on the Obvious Dangers We Ignore, by Michele Wucker (Amazon Affiliate Link) You Are What You Risk: The New Art and Science of Navigating an Uncertain World, by Michele Wucker (Amazon Affiliate Link) Why are Humans Bad at Calculating Risk?, Cogency Why You're Probably Not So Great at Risk Assessment, NY Times Why the Human Brain is a Poor Judge of Risk, Wired Humans are Terrible at Assessing Risk, by Kimberly Forsythe Why We're Awful at Assessing Risk, USA Today CISO Desk Reference Guides vol1 & vol2, by Bill Bonney, Gary Hayslip, Matt Stamper (Amazon Affiliate Link) Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter (Amazon Affiliate Link) The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer (Amazon Affiliate Link) Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski.
Apr 04, 2022
Fun and Games: Lock Picking, Capture the Flag Contests, Simulations, and More
3742
What images come to mind when you see or hear the word 'Cybersecurity?' That word probably evokes mental images of people hunched over keyboards launching cyberattacks at each other. Or maybe you picture someone picking a lock or stealing a badge to slip into a building. In other words, most people picture the battle... or what some might think of as "the fun parts." But, here's the thing. Not everyone gets to participate in these aspects of cybersecurity and, in many cases, finding safe and legal ways to practice these skills can be challenging. So where can curious minds turn? That's where gamification can really help. There are a ton of really fun and engaging ways to learn these skills without fear of being arrested or breaking something. These are also great ways to level-up cybersecurity skills and help bring new people into the field. In this episode, we explore the "fun and games" of cybersecurity: lock picking, (CTFs) capture the flag competitions, simulations, and even pickpocketing and magical (sleight of hand and misdirection) thinking. Perry's guests are Alethe Denis (social engineer and DefCon 2019 Social Engineering CTF winner), Deviant Ollam (penetration tester, lock picking guru, and Board Member of The Open Organization of Lockpickers), Chris Kirsch (Co-Founder and CEO of Rumble, DefCon 2017 Social Engineering CTF winner) , and Gerald Auger (Founder of Simply Cyber, Director of Cybersecurity Education & Cybersecurity Program Manager at ThreatGEN). Guests: Alethe Denis (LinkedIn) (Twitter) (Website) Deviant Ollam (Twitter) (YouTube) (Website) Chris Kirsch (LinkedIn) (Twitter) Gerald Auger (LinkedIn) (Twitter) (YouTube) Resources & Books: What is Gamification? Lockpicking Resources from Deviant Ollam Keys to the Kingdom: Impressioning, Privilege Escalation, Bumping, and Other Key-Based Attacks Against Physical Locks, by Deviant Ollam Practical Lock Picking: A Physical Penetration Tester's Training Guide, by Deviant Ollam TOOOL US -- The Open Organization of Lockpickers TOOOL US instructional videos on YouTube The Official TOOOL Slides The Lockpicking Lawyer on YouTube Bump Keys in the News - San Francisco #3 -- YouTube clip TraceLabs OSINT Capture the Flags 50 CTF (Capture the Flag) & Pentesting Websites to Practice Your Hacking & Cybersecurity Skills in 2021 Hands-on Hacking Demo | CTF - Capture the Flag in 15 Minutes!, YouTube video by ITProTV Capture the Flag? Change Your Life, YouTube video by John Hammond Don’t Wait for the Perfect Time for a Tabletop Exercise, National Law Review ThreatGEN's Red & Blue Game Gerald Auger's Simply Cyber Discord Server Chris Krisch's pickpocketing talk at Layer8 Security Conference Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com
Mar 22, 2022
World's Greatest Con – A Conversation with Brian Brushwood
4011
If you love learning about cons, scams, and tricks, then this is the episode for you. Listen as Perry sits down with Brian Brushwood, someone who has made understanding and teaching scams and tricks his life's work. Brian is the creator of Scam School, Scam Nation, Hacking the System, Modern Rogue, and more. For the past 20 years, he's toured around the world teaching and demonstrating everything from side show stunts, to sleight-of-hand magic, to the intricacies of con artistry. Brian’s new podcast, World’s Greatest Con is a deep-dive into the stories and tactics behind the most intricate and interesting cons imaginable. In season 1, he told the story of Operation Mincemeat, a WWII plot devised by Ian Fleming (creator of James Bond) to trick none other than Adolf Hitler. Season 2 covers five different cons all related to the game show industry… it’s both entertaining and riveting in some very unexpected ways. A big thank you to my friends over at the PodCube podcast for creating a custom skit for this episode. If you are a fan of sketch comedy, be sure to check out their show! (PodCube: The Future, is Yesterday™). Guest: Brian Brushwood (Website) (Twitter) Books and Resources Brian's Website World's Greatest Con podcast site Scam School YouTube Channel Modern Rogue YouTube Channel Brian Brushwood Mistreats His Tongue Brian doing psychic surgery on Penn & Teller: Fool Us Brian doing the "hidden ghost" trick Brian's Entire Bizarre Magic Stage Show How to make a fake tongue (without using a deer tongue) Operation Mincemeat -- Wikipedia 13 Unbelievably Fascinating Game Show Cheating Scandals That'll Shock Both Devoted And Casual Fans -- Buzzfeed Project Alpha -- Wikipedia Going Mental: A Conversation with Banachek -- 8th Layer Insights S1E7 PodCube Podcast Thinking, Fast and Slow by Daniel Kahneman  Influence, New and Expanded: The Psychology of Persuasion by Robert Cialdini Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits: The opening skit featured the voice talents of Rich Daigle (a.k.a. Mouth Almighty), Hannah Trusty, Adriana Beals, and Rob McCollum. Writing support for this episode's opening section from Terry Hicks Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com
Mar 08, 2022
Security is Alive
2941
Every now and then you need to try something new. That's what this episode is. If you listened to Season 2, Episode 3 (Technology and the Law of Unintended Consequences), you may remember the mock interview with Janet, the virtual assistant. This episode expands that idea and features a set of four mock interviews -- all with security-related object. This is an interesting experiment to help flesh-out some ideas behind these objects, the reasons they exist, their motivations, and the situations in which they find themselves. On this episode, we have four guests: Samantha, a piece of facial recognition software with a really interesting idea, Dave the password who has a pretty bad sharing problem, Devon, a secure email gateway who is struggling with the weight of the world and Barb, the phishing email who will say just about anything possible to get you to click that link. Guests:  Samantha – Facial Recognition Software Dave – Password Devon – Secure Email Gateway Barb – Phishing Email Books and Resources: MasterClass -- Margaret Atwood Teaches Creative Writing "Everything is Alive" Podcast Krebs on Security - Password Do’s and Don’ts What makes a good password? 9 rules to protect you from cyberattacks World Password Day: Roger Grimes on passwords Q&A With Data-Driven Evangelist Roger Grimes on the Great Password Debate How does facial recognition work? Facial recognition: top 7 trends (tech, vendors, use cases) NISTIR 8238 Ongoing Face Recognition Vendor Test (FRVT) Part 2: Identification How Accurate are Facial Recognition Systems – and Why Does It Matter? Social Engineering Red Flags Email Security Gap Analysis Shows 10.5% Miss Rate What are Email Security Gateways, How Do They Work, and What Can They Offer Your Organization? The Creative Writing Coursebook: 40 Authors Share Advice and Exercises for Fiction and Poetry On Writing: A Memoir of the Craft by Stephen King Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits: Additional voice talent provided by Luna Freyava, Rich Daigle (a.k.a. Mouth Almighty), Punyaha Mukherjee, and Tabitha Garland Music and Sound Effects by Blue Dot Sessions, Envato Elements, & SmartSound Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com
Feb 22, 2022
How to Fool The White House -- A conversation with James Linton (aka The Email Prankster)
3960
On this episode, Perry sits down with James Linton (formerly known as The Email Prankster). In 2017, James went on a virtual joyride exploiting the ways that people interact with emails. One of the most interesting things about James' story is that his exploits didn't rely on any type of highly technical method(s); they were simple display name deceptions. But that didn't stop him from fooling CEOs from some of the worlds largest banks, celebrities, and high ranking staff members in the White House. James' success using these simple methods serves as a warning for us all. We don't fall for scams because they are technically sophisticated or because we are stupid. We fall for scams because we are human. Guest: James Linton (LinkedIn) (Website) Books and Resources: Anatomy Of An Email Impersonation Spree: Who Got Pranked And Why An email prankster is hitting the CEOs of the world's biggest banks How to Prank the Rich and Powerful Without Really Trying Morgan Stanley CEO James Gorman falls for email prank This Man Pranked Eric Trump And Harvey Weinstein — Now He Just Wants A Job Media Coverage YouTube Playlist James Linton -- Wikipedia Entry The Journal of Best Practices: A Memoir of Marriage, Asperger Syndrome, and One Man's Quest to Be a Better Husband by David Finch Perry -- Interview on Springbrook's Converge Autism Radio Perry -- Security Weekly Interview Perry Carpenter - The Aspies Guide to Social Engineering - DEF CON 27 Social Engineering Village Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits: Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com
Feb 08, 2022
Bridging the Cyber Skills Gap
2998
If you've been following the cybersecurity industry for the past few years, you've likely heard about the "cyber skills gap." In this episode, Perry sits down with Heath Adams (TCM Security), Professor Karla Carter (Bellevue University), Sam Curry (Cybereason), and Lola Obamehinti (eBay) to explore what the skills gap is and how to begin to close the gap. We touch on subjects such as where traditional degrees, online training, certifications, mentorship, and networking fit in, as well as the value of diversity. And we offer thoughts for employers, current industry professionals, and job seekers. Guests: Heath Adams (LinkedIn) Karla Carter (LinkedIn) Sam Curry (LinkedIn) Lola Obamehinti (LinkedIn) Books and Resources: Confident Cyber Security: How to Get Started in Cyber Security and Futureproof Your Career, by Dr. Jessica Barker Cybersecurity Domain Map ver 3.0 by Henry Jiang Cybersecurity Employment in 2022: Solving the Skills Gap, by Jenn Fulmer Cybersecurity: The Starting Line, by 4n6Lady The 8 CISSP domains explained, by Luke Irwin Examination of Personality Characteristics Among Cybersecurity and Information Technology Professionals, by Sarah E. Freed (utc.edu) GenCyber Camps: Inspiring the Next Generation of Cyber Stars NSA National Centers for Academic Excellence in Cybersecurity Navigating the Cybersecurity Career Path by Hellen E. Patton Over 200,000 Girl Scouts Have Earned Cybersecurity Badges by Ashley Savageau Tribe of Hackers: Cybersecurity Advice from the Best Hackers in the World, by Marcus J. Carey & Jennifer Jin The Value of Certifications, by Javvad Malik Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter Word Notes Podcast definition of Cybersecurity Skills Gap Production Credits: Additional voice talent provided by Rich Daigle. Additional research by Nyla Gennaoui. Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ *** Use of The Twilight Zone theme music in this episode is considered 'Fair Use' under copyright law due to its 'transformative' nature as a parody. Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com
Jan 25, 2022
Technology & the Law of Unintended Consequences
3184
Let's face it. Most of us have a love/hate relationship with technology and technological advances. We dream about the new thing... but when it arrives, we are usually a little disappointed. Many of us also lament the constant erosion of privacy, the changes in social norms, and more. And, little-by-little, we allow those aspects of new technology to make us numb. We accept the cognitive dissonance of not totally being happy with the trade-offs; yet we still make the trade. In this episode, we explore a few of the positives and some of the unintended consequences associated with recent technological advancements. We'll hear from Dr. Lydia, Kostopoulos, Dr. Charles Chaffin, Andra Zaharia, and Aaron Barr. Guests: Dr. Lydia Kostopoulos (LinkedIn) (Website) Dr. Charles Chaffin (LinkedIn) (Website) Andra Zaharia (LinkedIn) (Website) Aaron Barr (LinkedIn) (Website) Books and Resources: Everything is Alive by PRX and Radiotopia IEEE Article: Decoupling Human Characteristics from Algorithmic Capabilities by Dr. Lydia Kostopoulos Numb: How the Information Age Dulls Our Senses and How We Can Get them Back by Dr. Charles Chaffin The Numb Podcast by Dr. Charles Chaffin The Cyber Empathy Podcast by Andra Zaharia Reminder: Your 'smart AI' often involves a low-paid contractor surveilling you How creepy is your smart speaker? Newton's Laws of Motion Unintended Consequences Elon Musk's warning regarding AI Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors Production Credits: Additional voice talent provided by Kristina Leigh. Additional research by Nyla Gennaoui. Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com
Jan 11, 2022
You're Listening to "The Dark Stream"
2777
And now for something completely different. This episode is a show within a show. Get ready to step into The Dark Stream: it's a parody of one of those old late night paranormal, conspiracy, or confession call-in radio shows from the 1980's and 90's. And, yes, it's over-the-top and cheesy. In this episode, you'll hear some re-edited and never before aired sections from Perry's previous interviews with Rachel Tobac, Maxie Reynolds, and Chris Hadnagy. Guests: Rachael Tobac: (LinkedIn), CEO of SocialProof Security Maxie Reynolds (LinkedIn), Founder of Subsea Cloud Chris Hadnagy: (LinkedIn); CEO of Social Engineer, LLC; Founder of Innocent Lives Foundation; Founder of Social-Engineer.org Recommended Books and Resources: CNN coverage of Rachel Tobac using social engineering to ruin Donie O'Sullivan's day Human Hacking: Win Friends, Influence People, and Leave Them Better Off for Having Met You by Chris Hadnagy The Art of Attack: Attacker Mindset for Security Professionals by Maxie Reynolds Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter Production Credits: Additional voice talent provided by Rich Daigle (a.k.a. Mouth Almighty) and Sarah McQuiggan Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/
Dec 28, 2021
Igniting and Sustaining Creativity
3559
This episode is all about creativity: what it is, what it looks like, and what to do when you get stuck. Perry speaks with four experts who have made creating new and interesting things their life's work. Featuring Jack Rhysider (Creator/host of Darknet Diaries), Faith McQuinn (creator of Boom, Margaritas & Doughnuts, and Apollyon), Tom Buck (YouTuber and content creator), and Sam Qurashi (Exploring the Psychology of Everything). Guests: Jack Rhysider Faith McQuinn Tom Buck Sam Qurashi Resources & Books: The No. 1 Habit of Highly Creative People Alchemy: The Dark Art and Curious Science of Creating Magic in Brands, Business, and Life Seven Techniques For Getting Creatively Unstuck The Unusual Habits Of 8 Famous Creative Minds The World's Most Creative People Have This Thing in Common You Are an Artist: Assignments to Spark Creation Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors Additional research by Nyla Gennaoui. Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/
Dec 14, 2021
Security ABCs Part 2: 8th Layer Insights and the Quest for Security Culture
4102
This is the second of a two part series covering Cybersecurity’s ABCs: Security Awareness, Behavior, and Culture. This episode discusses the difficulty that security leaders have in defining what a security culture actually is. Luckily, we can draw on learnings from organizational culture management and culture transformation experts. Guests for this episode include, David Sturt, Executive Vice President of the O.C. Tanner Institute, author of Great Work: How to Make a Difference People Love and Appreciate: Celebrating People, Inspiring Greatness., Dr. Jessica Barker (co-CEO and Co-Founder, Socio-Technical Lead at Cygenta; author of Confident Cyber Security and co-author of Cybersecurity ABCs), Kai Roer, Chief Research Officer at KnowBe4, creator of the Security Culture Framework, author of Build a Security Culture, and Michael Leckie, founding partner at Silverback Partners, LLC and author of The Heart of Transformation: Build the Human Capabilities that Change Organizations for Good. Guests: David Sturt Dr. Jessica Barker Kai Roer Michael Leckie References, Resources & Books: 4 Ways to Build a Thoughtful Security Culture, by Perry Carpenter 7 Tips for Building a Strong Security Culture, by Perry Carpenter Appreciate: Celebrating People, Inspiring Greatness, by David Sturt Build a Security Culture, by Kai Roer Confident Cyber Security: How to Get Started in Cyber Security and Futureproof Your Career, by Jessica Barker Culture Rules! The 10 Core Principles of Corporate Culture, by John R. Childress Cybersecurity ABCs: Delivering awareness, behaviours and culture change, by Jessica Barker, Adrian Davis, and Bruce Hallas Great Work: How to Make a Difference People Love, by David Sturt The Heart of Transformation: Build the Human Capabilities that Change Organizations for Good,, by Michael Leckie The Importance Of A Strong Security Culture And How To Build One, by Perry Carpenter Perry Carpenter's (ISC)2 Info Security Professional Journal 4 episode series on Security Awareness (Episode 1, Episode 2, Episode 3, Episode 4) Security Culture and Credential Sharing, KnowBe4 Research Security Culture Report 2021: A Global Security Culture Perspective During a Pandemic, KnowBe4 Research Seven Dimensions of Security Culture, KnowBe4 Research Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski.
Sep 28, 2021
Security ABCs Part 1: Make Awareness Transformational
3314
This is the first of a two part series covering Cybersecurity’s ABCs: Security Awareness, Behavior, and Culture. We touched on facets of Awareness in Episode 1 and Behavior in Episode 3. These two episodes cover the cybersecurity ABCs in a very pragmatic way, with this episode covering Awareness and Behavior and Episode 10 providing a deep dive into Culture. Guests for this episode include, Dr. Jessica Barker (co-CEO and Co-Founder, Socio-Technical Lead at Cygenta; author of Confident Cyber Security and co-author of Cybersecurity ABCs), Chrysa Freeman (Senior Program Manager for Security Awareness at Code42), Ian Murphy (Founder, CyberOff), and Lauren Zink (Senior Security Awareness Specialist at Boeing; author of LinkedIn Learning courses: Creating a Security Awareness Program and Building a Security Awareness Program: Phishing Simulations). Guests: Dr. Jessica Barker Chrysa Freeman Ian Murphy Lauren Zink References, Resources & Books: 5 Things You May Not Know About Security Awareness Training, by Perry Carpenter Confident Cyber Security: How to Get Started in Cyber Security and Futureproof Your Career, by Jessica Barker Cybersecurity ABCs: Delivering awareness, behaviours and culture change, by Jessica Barker, Adrian Davis, and Bruce Hallas The Dilemma: Should you phish test during the COVID-19 pandemic?, by Perry Carpenter Down the Rabbit Hole: Why People Question the Value of Security Awareness, by Perry Carpenter Do You Care More about What Your People Know, or What they Do? Coming to grips with the knowledge-intention-behavior gap, by Perry Carpenter The Fundamental Importance of Choice and Variety in Security Awareness Program Content, by Perry Carpenter G.I. Joe Public Service Announcements compilation Perry Carpenter's (ISC)2 Info Security Professional Journal 4 episode series on Security Awareness (Episode 1, Episode 2, Episode 3, Episode 4) People-Centric Security: Transforming Your Enterprise Security Culture, by Lance Hayden Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter Video: Simulated Phishing Campaign Notification for Your Users Video: Coronavirus Phishing Post-Click User Education Well Aware: Master the Nine Cybersecurity Habits to Protect Your Future, by George Finney What Reese’s Peanut Butter Cups can Teach Us about the Technology vs. Training Debate, by Perry Carpenter Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski.
Sep 14, 2021
The Risk Episode: Black Swans, Grey Rhinos, Angels & Demons
3160
Risk is a funny thing – our minds are constantly looking for risk, scanning our environments and our available choices. And sometimes we do a great job at anticipating and avoiding risky situations. But that doesn’t mean that we are universally good at dealing with risk. In fact, we can be downright appalling at considering and avoiding risk. In this episode, we explore the concept of risk, why we're so bad at understanding it, and the steps we can take to improve. Perry speaks with four risk experts who will help us understand the ups and downs of how we evaluate risk. We’ll touch on everything from Black Swans to Grey Rhinos to risk frameworks, risk equations, inbuilt risk in the design of computing interfaces, and more. Featuring Michele Wucker (author of The Grey Rhino and You Are What You Risk), Christian Hunt (Founder of Human Risk), Dr. Arun Vishwanath (Founder and Chief Technology Officer of Avant Research Group), and Matt Stamper (Chief Information Security Officer and Executive Advisor at EVOTEK and co-author of the CISO Desk Reference Guides vol1 & vol2). Guests: Michele Wucker Christian Hunt Arun Vishwanath Matt Stamper Resources & Books: Black Swan Theory Grey Rhino Events Various Risk Equations Risk Perception Equation, Freakonomics 20 Cognitive Biases That Affect Risk Decision Making, SafetyRisk.net Factor Analysis of Information Risk (FAIR) Framework The Gray Rhino: How to Recognize and Act on the Obvious Dangers We Ignore, by Michele Wucker You Are What You Risk: The New Art and Science of Navigating an Uncertain World, by Michele Wucker Why are Humans Bad at Calculating Risk?, Cogency Why You're Probably Not So Great at Risk Assessment, NY Times Why the Human Brain is a Poor Judge of Risk, Wired Humans are Terrible at Assessing Risk, by Kimberly Forsythe Why We're Awful at Assessing Risk, USA Today CISO Desk Reference Guides vol1 & vol2, by Bill Bonney, Gary Hayslip, Matt Stamper Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski.
Aug 31, 2021
Going Mental: A Conversation with Banachek
4285
In this episode, Perry Carpenter sits down with renowned mentalist and skeptic, Banachek. Banachek (Steve Shaw) grew up with a fascination in magic and a frustration with psychic frauds. As a teenager, he contacted magician and skeptic, James “The Amazing” Randi and ended up working with Randi on a special initiative known as Project Alpha, which set out to expose a general lack of objectivity in parapsychology research. Banachek served as the director for the James Randi Educational Foundation’s “One Million Dollar Paranormal Challenge” for 15 years and is now the President of the James Randi Educational Foundation.  Perry and Banachek discuss Project Alpha, the ways of fake psychics and fraudulent faith healers, and issues associated with confirmation bias and framing effects. They also discuss Banachek’s new live mentalism show in Las Vegas, which incorporates theatrical mindreading and other mentalism effects along with a storyline that explores Banachek’s life, antics, and passion for critical thinking. Guest: Banachek (Website) (twitter): Mentalist (Performing in Las Vegas add 'social' for 30% off tickets), Skeptic, President of the James Randi Educational Foundation This episode also featured a quick comment from: George Finney: (LinkedIn); Chief Security Officer at Southern Methodist University; Founder of Well Aware Security Books and References: Banachek Wikipedia entry Project Alpha Wikipedia entry James Randi Wikipedia entry Article about Houdini's efforts to debunk fake mediums The Discoverie of Witchcraft Wikipedia entry The Psychology of the Ouija Barnum Effect Wikipedia entry James Randi & Project Alpha Video Project Alpha lookback -- James Randi and Michael Edwards Psychological Subtleties vol 1, by Banachek Behind the Scenes with the Mediums, by David Abbott The Discoverie of Witchcraft Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter Music and Sound Effects by Blue Dot Sessions & Storyblocks. Artwork by Chris Machowski.
Aug 17, 2021
Embrace an Attacker Mindset to Improve Security
3839
Have you ever taken time to view the world through the eyes of an attacker? Doing so is an interesting and useful exercise. Understanding the mind of an attacker is fundamental to securing your organization or aspects of your personal life. After all, if you aren't doing the job of viewing things from an attacker's perspective, that means that only the attackers are. The idea is to understand the mindset, motivations, and capabilities of a possible threat actor so that you aren’t simply oblivious to your vulnerabilities.  This episode is a deep dive into attacker mindsets, we’ll hear from four experts who really know what it is to view the world through the eyes of an attacker. Featuring Chris Kirsch (DEF CON Social Engineering CTF Black Badge winner and co-founder of Rumble, Inc.), David Kennedy (Founder of Binary Defense and TrustedSec), Maxie Reynolds (Author of The Art of Attack: Attacker Mindset for Security Professionals, and Technical Team Leader, Social-Engineer, LLC), and Ted Harrington (Author of Hackable: How to Do Application Security Right, and Executive Partner at Independent Security Evaluators). Guests: Maxie Reynolds (https://www.linkedin.com/in/maxiereynolds/) David Kennedy (https://www.linkedin.com/in/davidkennedy4/) Chris Kirsch (https://www.linkedin.com/in/ckirsch/) Ted Harrington (https://www.linkedin.com/in/securityted/) Books and References: Bruce Schneier blog about the Security Mindset: https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html Origin of "Devil's Advocate": https://allthatsinteresting.com/devils-advocate-origin Lockheed Martin Cyber Kill-Chain: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html What is Threat Modeling: https://securityintelligence.com/posts/what-is-threat-modeling-and-how-does-it-impact-application-security/ 12 Methods of threat Modeling: https://insights.sei.cmu.edu/blog/threat-modeling-12-available-methods/ The Art of Attack: Attacker Mindset for Security Professionals by Maxie Reynolds Hackable: How to Do Application Security Right by Ted Harrington The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick Threat Modeling: Designing for Security by Adam Shostack Threat Modeling: A Practical Guide for Development Teams by Izar Tarandach and Matthew J. Coles Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter Music and Sound Effects by Blue Dot Sessions & Storyblocks. Artwork by Chris Machowski.
Aug 03, 2021
Going Meta: A Conversation and AMA with Bruce Schneier
3258
In this episode, Perry Carpenter interviews cybersecurity guru Bruce Schneier. Perry and Bruce explore how cybersecurity is about so much more than technology — It’s about people, so we benefit by taking a multidisciplinary approach.  In preparing for this interview, Perry solicited his LinkedIn network to see what questions people had for Bruce. This is a wide ranging conversation covering everything from Bruce’s thoughts on cybersecurity’s “first principles” to the impact that the pandemic had on society to need for regulation to help raise the overall standards for security and privacy. Guest: Bruce Schneier (https://www.schneier.com/blog/about/) (https://twitter.com/schneierblog) Bruce's personal website 'about me' page: https://www.schneier.com/blog/about/ Wikipedia article about Bruce Schneier: https://en.wikipedia.org/wiki/Bruce_Schneier Another background article about Bruce: https://www.cybersecurityeducationguides.org/bruce-schneier-legendary-cryptographer/ More Background on Bruce: http://academickids.com/encyclopedia/index.php/Bruce_Schneier Bruce's Solitaire encryption algorithm: https://www.schneier.com/academic/solitaire/ More info on the Solitaire algorithm: https://www.schneier.com/blog/archives/2019/10/more_cryptanaly.html Proximity Blindness: https://dannyozment.com/cant-see-the-forest-for-the-trees-the-dangers-of-proximity-blindness-2/ The story of the Blind Men and an Elephant: https://en.wikipedia.org/wiki/Blind_men_and_an_elephant Cryptography After the Aliens Land: https://www.schneier.com/essays/archives/2018/09/cryptography_after_t.html Secrets and Lies book preface with "If you think" quote: https://www.schneier.com/books/secrets-and-lies-pref/ "if you think cryptography" quote: https://news.ycombinator.com/item?id=19589899 Recommended Books (Amazon affiliate links): Applied Cryptography: Protocols, Algorithms and Source Code in C, by Bruce Schneier Beyond Fear: Thinking Sensibly About Security in an Uncertain World, by Bruce Schneier Click Here to Kill Everybody: Security and Survival in a Hyper-connected World, by Bruce Schneier Cryptography Apocalypse: Preparing for the Day When Quantum Computing Breaks Today's Crypto, by Roger Grimes Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World, by Bruce Schneier Liars and Outliers: Enabling the Trust that Society Needs to Thrive, by Bruce Schneier Secrets and Lies: Digital Security in a Networked World, by Bruce Schneier Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter Music and Sound Effects by Blue Dot Sessions & Storyblocks. Artwork by Chris Machowski.
Jul 20, 2021
Deceptionology 101: Introduction to the Dark Arts
3687
Have you ever noticed how fundamental deception is to the human condition? Deception and forms of social engineering have been with us since the beginning of recorded history. And yet, it seems like we are just as vulnerable to it as ever. But now the stakes are higher because technology allows social engineers to deceive at scale. This episode explores the psychology of deception, provides a foundation for understanding social engineering, offers a few mental models for exploration and exploitation, and discusses how we can prepare our mental defenses. Guests: Rachael Tobac: (LinkedIn), CEO of SocialProof Security Chris Hadnagy: (LinkedIn); CEO of Social Engineer, LLC; Founder of Innocent Lives Foundation; Founder of Social-Engineer.org Lisa Forte: (LinkedIn); Partner at Red Goat Cyber Security; Co-Founder Cyber Volunteers 19 George Finney: (LinkedIn); Chief Security Officer at Southern Methodist University; Founder of Well Aware Security Notes & Resources: CSO Online article on Social Engineering OODA Loop Understanding Framing Effects More examples of Framing Effects Harvard Business Review article on the Principles of Persuasion A blog series I did on Deception (Part 1), (Part 2). PsychologyToday article on Social Engineering Recommended Books (Amazon affiliate links): The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick Ghost in the Wires: My Adventures as the World's Most Wanted Hacker by Kevin Mitnick Human Hacking: Win Friends, Influence People, and Leave Them Better Off for Having Met You by Chris Hadnagy Influence, New and Expanded: The Psychology of Persuasion by Robert Cialdini Pre-Suasion: A Revolutionary Way to Influence and Persuade by Robert Cialdini Practical Social Engineering: A Primer for the Ethical Hacker by Joe Gray Social Engineering: The Science of Human Hacking by Chris Hadnagy Thinking, Fast and Slow by Daniel Kahneman. Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter Well Aware: Master the Nine Cybersecurity Habits to Protect Your Future by George Finney Music and Sound Effects by Blue Dot Sessions & Storyblocks. Artwork by Chris Machowski.
Jul 06, 2021
This is BS!
4123
Ever wrestled with the fact that people often make horrible security decisions even though their employers have security awareness programs in place? It's often because we assume that being aware of something should naturally result in better behavior. Well... that's not the case. This episode takes a deep dive into the knowledge-intention-behavior gap where we are confronted with three realities of security awareness. And those realities lead us to the realization that we need to focus on behavior. Guests for this episode are all leaders in the fields of Behavioral Science. They are, BJ Fogg, Ph.D., author of Tiny Habits: the Small Changes that Change Everything, Matt Wallaert, author of Start at the End: How to Build Products That Create Change, and Alexandra Alhadeff, co-author of Deep Thought: A Cybersecurity Story. Guests: BJ Fogg, Ph.D.. -- Behavior Scientist & Innovator at Stanford University. (Personal website) Author of Tiny Habits: The Small Changes That Change Everything. (Amazon link) Matt Wallaert -- Head of Behavioral Science at frog (a Capgemini company). Author of Start at the End: How to Build Products That Create Change (Amazon link) Alexandra Alhadeff -- Behavioral Scientist & Product Manager at The Fabulous. (Personal website) Notes & Resources: BJ Fogg testimony to the 2006 US Federal Trade Commission about the dangers of persuasive technology. Fogg Behavior Model About Nudge Theory Multiple examples of Nudging Great catalog of Dark Patterns Ideas42 cybersecurity-related behavioral science research. Deep Thought: A Cybersecurity Story, by Ideas42. Recommended Books (Amazon affiliate links): Tiny Habits: The Small Changes That Change Everything, by BJ Fogg, Ph.D. Start at the End: How to Build Products That Create Change, by Matt Wallaert Nudge: Improving Decisions About Health, Wealth, and Happiness, by Richard Thaler and Cass Sunstein Inside the Nudge Unit: How Small Changes Can Make a Big Difference, by David Halpern Evil by Design: Interaction Design to Lead Us into Temptation by Chris Nodder Thinking, Fast and Slow by Daniel Kahneman. Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter. Music and Sound Effects by Blue Dot Sessions & Storyblocks. Artwork by Chris Machowski.
Jun 22, 2021
The Battle for Truth: Disinformation, Misinformation, & Conspiracies
3832
This is an episode about the battle for truth. As disinformation, misinformation, malinformation, and conspiracy theories seem to be hitting epidemic levels, how can we help each other determine what is real and what is fake? How can we help people who are falling down conspiracy rabbit holes? And what roles do technology companies, governments, and ordinary citizens play? Perry Carpenter speaks with acclaimed cybersecurity expert, Bruce Schneier, disinformation experts, Samantha North and Allie Wong, and conspiracy theory researcher, Mick West. In this episode, we also hear from Peter Leyden from Reinvent and Eli Periser, author of The Filter Bubble. Learn more about our guests here: Bruce Schneier - Internationally renowned security technologist, author, and speaker. You can find Bruce's website here. Allie Wong - VP of Mis/dis/mal-information, Response and Resiliency, Limbik; Consultant, United Nations Institute for Disarmament Research. (LinkedIn) Samantha North - Disinformation researcher and consultant. (LinkedIn) Co-Founder: North Cyber Research (website) Mick West - Skeptical investigator and retired video game programmer. Creator of the websites Contrail Science (website) and Metabunk (website). Author of Escaping the Rabbit Hole: How to Debunk Conspiracy Theories Using Facts, Logic, and Respect (link). Personal website (link). Special thanks to Reinvent for allowing use of audio. References: http://reinvent.net/events/event/how-we-can-pop-the-filter-bubble-with-eli-pariser/ https://reboot-foundation.org/study-social-media-poor-judgment/ https://reboot-foundation.org/is-there-a-fake-news-generation/ Recommended Books (Amazon affiliate links): Escaping the Rabbit Hole: How to Debunk Conspiracy Theories Using Facts, Logic, and Respect by Mick West. Click Here to Kill Everybody: Security and Survival in a Hyper-connected World by Bruce Schneier. The Filter Bubble: How the New Personalized Web Is Changing What We Read and How We Think by Eli Pariser. Thinking, Fast and Slow by Daniel Kahneman. Why Are We Yelling?: The Art of Productive Disagreement by Buster Benson. The Righteous Mind: Why Good People Are Divided by Politics and Religion by Jonathan Haidt. Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter. Music and Sound Effects by Blue Dot Sessions & Storyblocks. Artwork by Chris Machowski.
Jun 08, 2021
Unleashing Trojan Horses for the Mind
3158
This episode explores the concept of “Trojan Horses for the Mind.” There are four Trojan Horses. They are: emotion, sound, visuals, and words/story. Using these Trojan Horses will help us increase the signal to noise ratio in our communications, bypass mental defenses, and embed messages within the minds of our audiences. To explore the concepts related to this, Perry speaks with voice actor, writer, and producer, Rob McCollum; author, marketer, and storytelling expert Joe Lazauskas; and executive storyteller coach and trainer, Stephanie Paul. Learn more about our guests here: Rob McCollum -- Voice actor, script writer, director, producer (LinkedIn). Rob's IMDB page. Joe Lazauskas -- Head of Marketing at Contently. Author of, The Storytelling Edge. LinkedIn. Amazon affiliate link to book. Stephanie Paul -- Executive Storyteller, Coach, Speaker, and Trainer (LinkedIn). Stephanie's website. Resources: Special offer: Stephanie Paul is offering a $5.00 discount off her book, The WhyGuide to Storytelling. Just visit here and use the coupon code HACK4U at checkout. For more about the Trojan Horses for the Mind, check out Perry’s book, Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors. Amazon affiliate links to books mentioned: The Storytelling Edge Save the Cat! Transformational Security Awareness Music and Sound Effects by Blue Dot Sessions & Storyblocks. Artwork by Chris Machowski.
May 25, 2021
Introducing 8th Layer Insights
274
Coming May 25, 2021. Get ready for a deep dive into what cybersecurity professionals often refer to as the "8th Layer" of security: HUMANS. This podcast is a multidisciplinary exploration into how the complexities of human nature affect security, risk, and life. Author, security researcher, and behavior science enthusiast Perry Carpenter taps experts for their insights and illumination. Topics include cybersecurity, psychology, behavior science, communication, leadership, and more.
May 04, 2021