Risky Business

By Patrick Gray

Listen to a podcast, please open Podcast Republic app. Available on Google Play Store.


Category: Tech News

Open in Apple Podcasts


Open RSS feed


Open Website


Rate for this podcast

Subscribers: 1363
Reviews: 3


 Aug 1, 2021

Anders
 Jul 13, 2020


 Oct 10, 2018

Description

Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.

Episode Date
Risky Business #687 -- Shady deeds in sunny places: Ransomware smashes Vanuatu, Guadeloupe

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • UK, USA ban Chinese security cameras
  • What is the Boa webserver and why is it everywhere?
  • Vanuatu, Guadeloupe smashed by ransomware
  • REvil back with more dumps despite ASD attention
  • Much, much more

This week’s sponsor guest is Jake King from Elastic Security, who joins us to talk through the company’s most recent threat report. There’s a link to the report in our show notes.

Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.

Show notes

Nov 30, 2022
Risky Business #686 -- White House to move on spyware industry

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Half of all UK COBRA meetings are ransomware related
  • Ransomware biggest risk to US port security
  • White House to move on spyware industry
  • EU to launch its own Starlink equivalent
  • Much, much more

AttackIQ’s Jonathan Reiber will be joining us in this week’s sponsor interview to talk about how companies and their boards are really moving towards outcomes-based security programs.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Nov 23, 2022
Risky Biz Soap Box: How to get your developers invested in security

In this podcast we speak with Randall Degges who leads the Developer Relations & Community team at Snyk. He’s here to talk to us about how to get developers enthusiastic about security, how to get them to use the right tooling, and how this tooling will evolve in the future to actually help developers fix bugs in their code.

Show notes

Nov 21, 2022
Risky Business #685 -- Australia releases the hounds, and it might just work

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Australia lets ASD loose on ransomware crews, but will it work? (Tom Uren joins us to chat about this one)
  • Twitter’s wheels haven’t fallen off yet but they sure are wobbling
  • Hundreds of millions stolen from FTX mid implosion
  • Security researchers start looking at Mastodon and… yeah
  • Much, much more!

This week’s show is brought to you by Gigamon. George Sandford from Gigamon pops in for this week’s sponsor interview to talk about how to successfully stand up an NDR program.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Nov 16, 2022
Risky Business #684 -- DoJ seizes 50,000 stolen bitcoins from popcorn tin

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • DoJ seizes 50k bitcoin stolen from Silk Road, charges thief
  • Australian health insurer Medibank refuses to pay ransom, data leaked
  • Inside Qatar’s $386m world cup espionage operation
  • EU Parliament report into spyware lands
  • SolarWinds settles shareholder lawsuit, faces SEC enforcement action
  • Much, much more

This week’s sponsor guest is Andrew Morris from Greynoise Intelligence.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Nov 09, 2022
Risky Business #683 -- OpenSSL bug is a fizzer, ASD responds to Medibank hack

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Twitter bluechecks face phishing barrage
  • Australian government goes berserk on Medibank hack response
  • Former WSJ journalist sues law firm over email hack and info op that got him fired
  • OpenSSL bug lands with a whimper
  • Apple macOS Ventura update breaks security tools
  • Much, much more

This week’s show is brought to you by Thinkst Canary. Marco Slaviero, Thinkst’s head of engineering, joins us this week to talk through the company’s latest release, codenamed Quokka.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Nov 02, 2022
Snake Oilers: Truffle Security, KSOC and Snyk

Snake Oilers isn’t our regular weekly podcast, it’s a wholly sponsored series we do at Risky.Biz where vendors come on to the show to pitch their products to you, the Risky Business listener. To be clear – everyone you hear in one of these editions, paid to be here.

We’ll hear from three vendors in this edition of Snake Oilers:

  • Truffle Security talks secrets discovery
  • KSOC builds Kubernetes security tools
  • Snyk has a new product to better secure Infrastructure as Code
Oct 19, 2022
Snake Oilers: Tines, Code42 and Kroll

Snake Oilers isn’t our regular weekly podcast, it’s a wholly sponsored series we do at Risky.Biz where vendors come on to the show to pitch their products to you, the Risky Business listener. To be clear – everyone you hear in one of these editions, paid to be here.

We’ll hear from three vendors in this edition of Snake Oilers:

  • Tines, the no code security automation solution that people are going absolutely nuts over
  • Code42, the insider threat detection solution maker
  • Kroll talks about its MDR offering
Oct 14, 2022
Risky Business #682 -- Starlink goes dark on Ukraine's front line

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Why former Uber CISO Joe Sullivan’s guilty verdict shouldn’t worry you
  • United States puts chipmaking restrictions on China, APT activity is coming
  • Elon blinks and Starlink goes dark on Ukraine’s front line
  • Master cyber criminal arrested in Australia
  • Much, much more

This week’s show is brought to you by runZero, the asset inventory and network visibility solution. runZero’s founding CTO and industry legend HD Moore is this week’s sponsor guest.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Oct 12, 2022
Risky Business #681 -- It's Exchangehog Day

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • More Exchange 0days cause more havoc
  • A look at some earlier Exchange hack incidents
  • How the CIA got its agents killed with its truly awful online opsec
  • Ex NSA staffer arrested for espionage
  • Much, much more

This week’s show is brought to you by Proofpoint. Ryan Kalember, Proofpoint’s EVP of cybersecurity strategy, joins the show this week to talk about some overlooked detection opportunities – some simple stuff you can look for in your environment that should raise gigantic flashing red flags.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Oct 05, 2022
Risky Biz Soap Box: Why Microsoft's Smart Application Control is very strange

In this Soap Box podcast Patrick Gray interviews Airlock Digital CTO Daniel Schell and CEO David Cottingham about Microsoft’s new Smart Application Control feature, why controlling browser extensions via endpoint instrumentation is really hard and why PAM solutions don’t actually do allowlisting, even if they claim they do.

Sep 29, 2022
Risky Business #680 -- Uber, Rockstar Games hacker arrested

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Lapsus$’s Teapot arrested by UK police
  • Optus hacker issues grovelling apology after feeling AFP and ASD heat
  • Ukraine claims Russia is planning massive attacks on its infrastructure
  • RSOCKS bot herder begs for extradition to USA
  • Russians scammed when seeking military service exemptions
  • Much, much more

This week’s show is sponsored by Votiro. Ravi Srinivasan, Votiro’s CEO, joins the show this week to talk about how people are using content disarm and reconstruction.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Sep 28, 2022
Risky Business #679 -- A look at Uber's very bad week

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • A look at how Uber got owned so hard
  • Why cleartext cookie storage in Microsoft Teams’ Electron-based app is actually a big deal
  • Russian official: Starlink is a legitimate military target
  • Wagner mercs get doxxed
  • Kiwi Farms having a bad time
  • Much, much more

In this week’s sponsor interview we’ll be chatting to Nucleus’s CEO Steve Carter about CISA’s KEV list. He has feelings about the KEV list – they’re mostly positive, but he also has a few reasonable gripes and he joins me to talk about them.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Sep 21, 2022
Risky Biz Soap Box: Haroon Meer on "sensitive command tokens"

In this edition of the Soap Box podcast Patrick Gray talks to Haroon Meer about Thinkst Canary’s new sensitive command token. It’s a great way to detect intruders on your Windows systems. Haroon also talks about how to use canaries strategically.

Sep 15, 2022
Risky Business #678 -- Iranians Gone Wild

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Albania suffers under another crippling Iranian attack
  • Iran’s APT42 using clever, multi-persona phishing
  • State Department cyber snitching program paying off
  • Former NSA director Gen. Keith Alexander sued over alleged IronNet pump and dump
  • Mudge fronts US Senate Judiciary Committee
  • Much, much more…

This week’s show is brought to you by Stairwell. Mike Wiacek, Stairwell’s founder and CEO is this week’s sponsor guest and he talks about why they’ve pushed their Inception platform beyond YARA hunting. You can see a demo of Inception on our YouTube product demo page.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Sep 14, 2022
Risky Business #677 -- A day late and a dollar short: China doxxes NSA op

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • China’s super spies figure out Rob Joyce ran TAO ops
  • FBI, French authorities fly to Montenegro to investigate ransomware attack
  • NEWSFLASH: Cloudflare are still a bunch of Nazi cuddlers
  • SIM swap drama spills into real world shootings, firebombings
  • Yandex Taxi hack clogs Moscow streets
  • The TikTok breach that wasn’t
  • Project Raven veterans get wings clipped
  • Why recent BGP hijacks are getting a bit concerning
  • Much, much more

This week’s show is brought to you by Corelight, the company that maintains Zeek. Corleight’s Federal CTO Jean Schaffer joins us in this week’s sponsor interview to talk about whether or not the White House’s executive order on Zero Trust is actually changing anything.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Sep 07, 2022
Risky Business #676 -- Okta, Authy users among Twilio hack targets

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • The Twilio breach was actually a big deal
  • How a Belarusian Cyber Partisans hack burned a GRU illegal
  • Who wants 25m hashed passwords from Russia?
  • An NFT we can get behind
  • How attackers are using game anti-cheat drivers to defeat EDR
  • Much, much more

This week’s sponsor interview is with Mike Benjamin, the VP of security research at Fastly. He pops in to argue that your red team needs to actually consider how your apps will cope with bot-driven attacks.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Aug 31, 2022
Risky Business #675 -- The problem with Mudge's whistleblowing complaint

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • A deep look at Mudge’s sensational whistleblower complaint against Twitter
  • Brazilian Federal Police raid Lapsus$ crew
  • NSO CEO to stand down (again), 100 staff to be let go
  • Signal users impacted in Twilio incident
  • Tornado Cash OFACs around and finds out
  • Much, much more

This week’s show is brought to you by Greynoise. Its founder, Andrew Morris, joins the show with a stinging critique of the wider threat intelligence industry. Don’t miss that one.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Aug 24, 2022
Risky Biz Soap Box: Okta's Brett Winterford on session cookie theft and mitigations

In this edition of the Soap Box podcast Okta’s APAC CISO and former Risky Biz editor Brett Winterford talks about how attackers are getting much better at swiping session cookies via realtime phishing and malware.

He also talks about some mitigation strategies to combat this threat and introduces the concept of continuous authentication.

Aug 09, 2022
Risky Business #674 -- "Free money" exploit spawns $150m blockchain feeding frenzy

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Taiwan tensions fail to conjure the cyber apocalypse
  • Crypto bridge exploit results in $150m feeding frenzy
  • Chainalysis evidence to be challenged in court
  • Post-quantum NIST candidate algorithm gets smoked
  • DSIRF’s Russia links
  • Much, much more

This week’s sponsor interview is with Jerrod Chong from Yubico. He’s joining the show to talk about why consumer-focussed implementations of Webauthn like Apple’s Passkeys aren’t a great enterprise solution.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Aug 03, 2022
Risky Business #673 -- When throwing computers into a woodchipper is standard IR

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Why Entrust being ransomwared is good news
  • UEFI bootkits turn hardware into landfill
  • Microsoft resumes macro blocking rollout
  • Pat and Adam talk about why plugging your IDP into legacy apps is a dreadful idea
  • Much, much more

This week’s sponsor guest is Paul “The Voice” Lanzi of Remediant. He’s popping along to talk about the emergence of a new product category – Identity Threat Detection and Response, or ITDR.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Jul 27, 2022