Network Security Podcast

It's a week and a day late, it's the last episode of the year, and we're all too tired to be that excited about it.  Rich, Zach and Martin take a few minutes to look around before plunging on into the new year, and unluckily, we don't see much change in the air.  There's also a not-so-short interview with Mike Smith, Security Evangelist for Akamai Networks this week.  So while it's a good show to end the year with, there are no real stories to cover tonight, just some rambling by your hosts and a good interview.  About par for us.

Network Security Podcast, Episode 226, December 28, 2010

Time:  50:12

Music:  Brian Rath with Deep End

It's a show all about compromises.  And not the good kind that you do when you're married, rather the bad kind you experience when you have bad security or trust the wrong people.  McDonalds, Gawker, DeviantArt and there's probably one or two more that we haven't heard of yet.  Lots of people making lots of mistakes.  And if the Gawker incident is any indicator, there will be a lot more compromises because of password re-use over the next couple of weeks.  Isn't this a great way to start winding down the year?

Network Security Podcast, Episode 225, December 14, 2010
Time:  34:35

Show Notes:

• Potential Access to Customer Data by Unauthorized Third Party (McDonald's)
• The Real Lessons Of Gawker’s Security Mess
• DeviantArt Mailing List Compromized
• Acai Berry Twitter Attack Spreading Like Wildfire
• Why GSM-Based ATM Skimmers Rule
• BayThreat
• Tonight’s music – Inconvenient Compromise by Shadow Circus

We will not talk about that story.  We will not talk about that story.  Okay, we'll talk about THAT story a little, but no more than 10 seconds.  And we almost made it happen.  But despite our best intentions, we talked about the Wikileaks story tonight.  But only for about 10-20 seconds.  Honest.  Amazon's AWS getting listed as a Level 1 PCI compliant service provider on the other hand...well, you probably expected us to talk about it and we don't disappoint.  We hope.  In any case, here's this week's podcast with a little bit of musical flavor to give you an idea of our mood.

Network Security Podcast, Episode 224, December 7, 2010
Time:  31:34

Show Notes:

• Race is on to 'fingerprint' phones, PC's
• 10 tips to make TSA's security check as painless as possible - They missed "don't fly".
• Web sites are stealing browser histories
• DHS enlists the people of Walmart in our defense 
• From the concrete to the hypervisor:  Compliance and IaaS/PaaS Cloud - A shared responsibility
• 2010's biggest security SNAFU's - More like 2010's biggest security headlines
• Tonight's music - Koo Koo: Or How I achieved success, happiness and the American dream through insanity and clinical schizophrenia by Al Phlipp and the Woo Team

Rich is busy battling The Sickness, so Martin and Zach are running the show. Coming off of the post-Thanksgiving food comas, and nearly (but not quite) avoiding all of the hullaballoo around Wikileaks, tonight's show clocks in at a modest time.

Network Security Podcast, Episode 223, November 30, 2010
Time:  29:31

Show notes:

• I was just detained by the TSA
• Sites With Government Seized Domains Are Moving On, On Twitter
• WikiLeaked Diplomatic Cables Confirm China’s Politburo Was Behind Google Hacking Incident
• Savannah.gnu.org compromised
• Tonight’s Music:  Slo Leak with Same Damn Thing

We say at the start of tonight's podcast that it'd be short and we're all out of energy.  Well, we were half right.  Sometimes I think having less to to say makes us say it in many more words than we'd normally use. We did have a chance to talk about the Boston OWASP conference that Zach attended over the weekend and the cloud conference Rich presented at last week.  We did not talk about writing PCI Reports on Compliance however, since no one, not even Martin, considers that to be something to be talked about in polite company.

Network Security Podcast, Episode 222

Time:  40:21

Show Notes:

• 2011:  The Death of Security as we know IT or Operationalizing Security
• Security-patching common web development frameworks

Martin and Zach take the stage tonight, Rich has tagged off to have some quality time with some cloud folks down in Florida.  Which is too bad, since tonight's interview is with Alex Hutton, Martin's co-worker at Verizon Business.  Alex is introducing the VERIS Application, designed to anonymously collect information about security breaches and provide the user with metrics comparing their situation to those presented in the DBIR earlier this year.  Rich and crew at Securosis contributed to this effort, so maybe he'll be willing to talk next week.  Just maybe. 

Network Security Podcast, Episode 221, November 16, 2010

Time:  37:01

Show notes:

• Verizon Incident Classificationi and Reporting
• VERIS Framework Wiki
• BayThreat
• Tonight's Music:  We the Living with Best Laid Plans

November marks five years of the Network Security Podcast.  Think about that for a moment: five years of Martin mouthing off into a microphone, nearly three years of Rich and over 18 months of Zach.  A little scary when you think about, or at lease when we think about it.  We're probably going to put off celebrating much until hit episode 250, but we're still going to talk about how things have changed in that time.  And we also want to make sure that everyone who's listening knows how much all three of us appreciate that people still download the podcast week after week.

It's just Martin and Rich this week.  Zach is off somewhere getting paid real money while Martin is sick at home and Rich is saying "Can we hurry up so I can take my daughter to swim class."  In other words, pretty much situation normal.

Network Security Podcast, Episode 220, November 9, 2010
Time: 36:33

Show Notes:

• Who's firing off rockets in SoCal? - Rich says it's us, otherwise there'd be a bigger fuss
• Give me the power & the money - NSA Chief wants more power over the Internet.
• Things to think about when moving to the cloud - Dimitri McKay has 5 points to ponder
• The GSA needs some DLP (and TLC) - D'ooh, I didn't mean to send out 12,000 people's SSNs.
• Random thoughts from Anton - On PCI 2.0 that is
• Personal experiences with Vishing - Martin's credit union was targeted by robocalls trying to get cardholder information
• Tonight's music:  Cold Blooded Man by Sugar Blue