Network Security Podcast

We start the show off by wishing Martin luck with his presentation at the FIRST conference in Kyoto, foolishly trusting Rich with the keys to the podcast. Then Rich fawns over his iPhone 3GS a little too much, but he does manage to talk about some cool new security features.

Rich also rants a little on one of our PCI stories, and Martin updates us on his XBox wireless situation. Finally, we geek out a bit on Adam Savage appearing at DefCon.

Network Security Podcast, Episode 155
Time:  35:28

Show Notes:

• The Clear Card finally dies. What a scam.
• Mozilla reveals some new ways of combating XSS and Clickjacking. A positive move, but with a lot of caveats.
• An end user talks about his experiences with a WAF.
• DHS has a blog.
• Nevada mandates PCI. Even for non-credit card PII that wouldn't normally be covered.
• The National Retail Foundation whines about PCI. What a silly responses- back to the drawing board guys. I don't think you've even read the standard.
• Get your Certified Application Security Specialist hats, shirts, and other gear.
• Tonight's Music:  Reggae Far East with Cost Cut Japan
  

This week we had a chance to talk to Jeff Moss, the founder of a couple minor security events, Black Hat and Defcon.  Of course some would say that they're the biggest social events of the year, along with having the best presentations on cutting edge security research, but what do they know.  A lot apparently, given the number of security professionals and hackers who'll be be making the trip to Las Vegas at the end of July to attend both of these events.

Jeff was recently asked to be a part of the Homeland Security Advisor Council, a diverse group of sixteen individuals who will be advising the DHS and Secretary Napolitano on the security concerns they're seeing in the real world.  This group includes Govenors, both past and present, Mayors, CEO's and Presidents, though Mr. Moss is the only computer security expert.  Jeff is still learning about what this really means, but we spent a significant part of the interview talking about what it means and the agendas he personally would like to see pushed at the DHS.  One of his big concerns is the tradeoff we're making between security and privacy and if anyone is taking steps to measure those tradeoffs. 

Network Security Podcast, Episode 154, June 16, 2009
Time:  45:34

Rich was somewhere in the air over the Midwest today, which would have made recording a podcast questionable at best.  So rather than take any chances with technology, we got a stand in for him in the form of our very own Security Curmudgeon, Jack Daniel.  I met Jack face to face for the first time at one of the first big 'security' conferences I'd ever been to on the East Coast, Shmoocon 2007.  I haven't made it back for another conference recently, but when I do, I'm sure that there will be people like Jack who will give me a warm welcome.

Jack and I spend a little time bashing the CISSP yet again, we talk about some very interesting news stories and wrap up discussing getting involved in the security community.  All in all, another good show.

Network Security Podcast, Episode 153
Time:  41:41

Show Notes:

• T-mobile sources and data - Here's where the news started
• T-Mobile confirms stolen data is genuine
• T-Mobile confirms hackers' info is legit
• FTC sues, shuts down N. Calif. web hosting firm
• Google Translation of 3FN termination - Jack says read the comments
• UK web host falls victim to attack
• Webhost hack wipes out data for 100,000 sites - It doesn't matter if it's virtualization or cloud computing when you lose data.
  
• Yay, it's Patch Tuesday again!
• Tonight's Music:  Bradley West with Slow Train
  

We hope no one begrudges us for taking last week off due to the holiday, and we're back this week with all your juicy security goodness. After a short discussion of our mutual weekends spent recovering old hard drives and systems, we talk about the upcoming Black Hat and DefCon conferences before digging into the news. We discuss stories from a return of the L0pht Heavy Industries, to White House speeches, and Mac security.

Network Security Podcast, Episode 152, June 2, 2009
Time:  35:36

Show Notes:

• L0phtcrack 6 is officially released. It's alive!
• Judge rules Lifelock fraud service is illegal. This is a serious blow to consumers.
• The CardSystems auditor is being sued due to certifying a non-compliant company.
• White House releases cyberspace policy review.
• Jericho Forum and the Cloud Security Alliance join forces.
• The truth about Apple, security, and responsibility. Yes, Rich wrote it, but it's still good.