Full Show Notes
Segment One
SWVHSC: Put Zero Trust in Your Devices – John Loucaides – ESW #193
The recent shift to a remote work environment has created new challenges for many businesses and government institutions with profound impacts on organizational security models. Users are no longer protected by the many layers of security found on-premise in the corporate network. Organizations must adapt security policies to support a massive influx of inbound connections. Security teams must consider how to adapt core security concepts like Zero Trust to include remote work environments that include corporate laptops, BYOD devices, and home networking gear. Join our conversation as we discuss how much trust you can put in your devices as well as what organizations are doing to assess and verify device integrity down to the firmware and hardware level. Eclypsium will also discuss the #BootHoleVulnerability research they disclosed last week.This segment is sponsored by Eclypsium.Visit https://securityweekly.com/eclypsium to learn more about them!To learn more about securing devices down to the firmware and hardware level, visit: https://eclypsium.com/
Guest
John has extensive history in hardware and firmware threats from experience at Intel and the United States government. At Intel he served as the Director of Advanced Threat Research, Platform Armoring and Resiliency, PSIRT, and was a CHIPSEC maintainer. Prior to this, he was Technical Team Lead for Specialized Platforms for the US government.
Announcements
- Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.
Segment Two
DigiCert Automation Gateway, Veracode Security Labs, & CyberArk Shadow Admin – ESW #193
Tanium offering new cybersecurity service through a partnership with Google Cloud, CyberArk launches open-source Shadow Admin identification tool for Azure and AWS, Threat Stack Cloud Security Platform extends security observability to AWS Fargate tasks, Polyrize announces its SaaS-based security platform, and more!
Hosts
Announcements
- Don't miss any of your favorite Security Weekly content! Visit https://securityweekly.com/subscribe to subscribe to any of our podcast feeds and have all new episodes downloaded right to your phone! You can also join our mailing list, Discord server, and follow us on social media & our streaming platforms!
List of Articles
Paul Asadoorian
- Qualys acquires software assets of Spell Security (NASDAQ:QLYS)
- Tanium offers new cybersecurity service through partnership with Google Cloud – SiliconANGLE
- Google, Microsoft Join Hands to Work on Securing Your Emails
- CyberArk launches open-source Shadow Admin identification tool for Azure and AWS – SiliconANGLE
- Veracode Security Labs Community Edition launches to close the security gap – SD Times
- AttackIQ : Launches Preactive Security Exchange (PSE) to Improve Security Controls Effectiveness for Customers
- Citrix Web App and API Protection: Security for apps and APIs in the multi-cloud – Help Net Security
- Threat Stack Cloud Security Platform extends security observability to AWS Fargate tasks – Help Net Security
- Polyrize announces its SaaS-based security platform – Help Net Security
- RiskIQ joins Palo Alto Networks Cortex XSOAR Marketplace as a launch partner
- DigiCert Announces DigiCert Automation Gateway
- Aqua Extends its Alliance with Red Hat and IBM to Bring Cloud Native Security to the Red Hat Marketplace
Segment Three
SWVHSC: Mapping MITRE ATT&CK to PCI DSS – Jeff Man – ESW #193
MITRE ATT&CK seems to be the “next big thing”. Every time I hear about it I can’t help but wonder, “how do you prevent all these attacks in the first place? Shouldn’t that be the end game?” To that end, I set out to map all the recommended “Mitigations” for all the “Techniques” detailed in ATT&CK to see how many are already addressed by what is required in the Payment Card Industry Data Security Standard (PCI DSS). My hypothesis was all of them. The results were interesting and a little surprising, and I’m still trying to figure out how to best use the results and subsequently ATT&CK itself. I will present my findings in the briefing and hopefully generate a discussion about what to do with the results.
Guest
Cryptanalyst, infosec analyst, pioneering ex-NSA pen tester, PCI specialist and certified security curmudgeon. Currently a Sr. InfoSec Consultant for Online Business Systems.
Announcements
- We're always looking for great guests for all of the Security Weekly shows! Submit your suggestions by visiting https://securityweekly.com/guests and completing the form!
