David Mytton on Developer-Centric Security with ArcJet

Summary:

In this episode of Exploring Information Security, host Timothy De Block talks with David Mytton, founder of ArcJet, about enabling developers to build secure applications seamlessly. David shares his journey from running a cloud monitoring business to developing ArcJet, a security-as-code platform that integrates security measures directly into an application's codebase.

They discuss ArcJet's approach to empowering developers with tools for bot detection, rate limiting, and more, all without compromising the developer experience. David and Timothy explore the challenges of bridging the gap between development and security, the philosophy behind "DevSecOps," and how ArcJet addresses real-world issues like bot abuse and API misuse. Whether you're a developer, security professional, or tech enthusiast, this episode offers unique insights into making application security more accessible.

Key Topics Covered

  • What is ArcJet and the problem it’s solving?: A security-as-code platform designed for developers to integrate protections directly into their applications.

  • Developer-Centric Security: How ArcJet enhances security workflows by providing developers with intuitive SDKs and tools.

  • Real-World Use Cases: Stories of companies reducing infrastructure costs and mitigating bot-driven abuse with ArcJet.

  • The Evolution of DevSecOps: Challenges and opportunities in integrating security into the development lifecycle.

  • David's Philosophy: The importance of documentation, user experience, and building tools developers love.

Highlights

  • Developers can start using ArcJet with just a few lines of code.

  • ArcJet helps teams address spam, API abuse, and fraud while focusing on feature development.

  • David's perspective on the state of security tooling and how ArcJet stands out.

Guest Bio

David Mytton is the founder of ArcJet, a security-as-code platform. He previously founded a cloud monitoring business and has extensive experience with developer tools and application security. David is passionate about creating seamless developer experiences and advancing security tooling to meet modern demands.

Links and Resources

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


[RERELEASE] What is MS08-067?

In this artistic episode of the Exploring Information Security podcast, Mubix joins me to discuss MS08-067.

Mubix (@mubix), available at room362 and Hak5, joins me to discuss one of his favorite exploits: MS08-067. I invited Mubix on to talk about MS08-067 because of a tweet he retweeted. The tweet included a confession that a consultant used the MS08-067 vulnerability to break into a clients network. This vulnerability is really old and while not widespread it does pop-up from time-to-time. I was happy to discover that Mubix has a great appreciation for the exploit.

In this episode we discuss:

  • What is MS08-067?

  • How long has it been around?

  • Why is it still around?

  • What name it would be given in today

More resources:

Exploring the Defensive Security Handbook with Amanda Berlin

Summary:

In this episode of Exploring Information Security, host Timothy De Block sits down with Amanda Berlin, co-author of the Defensive Security Handbook, to discuss the evolution of the book, the challenges of writing for the blue team, and how it’s helping cybersecurity practitioners today. Amanda shares insights on creating accessible resources for security professionals and the importance of designing security that works for everyone, from SMBs to enterprise teams.

Key Takeaways:

  • Origins of the Handbook: Amanda reveals how the Defensive Security Handbook was born from her own challenges as a security professional and the lack of accessible, practical blue team resources.

  • Writing Process and Updates: The journey of creating the first edition and the significant updates in the second edition, including expanded cloud coverage and reorganized database content.

  • Designing Security for SMBs: Amanda highlights the unique challenges small and medium businesses face, from budget constraints to vendor complexities, and how the book aims to provide practical, scalable advice.

  • Balancing Technical and Practical: The handbook’s goal is to simplify complex concepts, making them digestible for newcomers while still useful for seasoned professionals seeking quick references.

  • The Importance of Empathy in Security: Amanda emphasizes the need for empathy in designing security tools and processes, especially for SMBs that lack dedicated resources or expertise.

  • Feedback and Impact: How the book has resonated with unexpected audiences, including developers and detection engineers, as a guide to understanding security concepts.

Resources Mentioned:

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


How to Create User-Centric Security with Javvad Malik

Summary:

In this episode of Exploring Information Security, host Timothy De Block and guest Javvad Malik, security awareness advocate and writer for KnowBe4, delve into the concept of user-centric design in security. Javvad shares insights on building security controls that enhance user experience rather than hinder it, and explores how organizations can foster a security culture by making processes more intuitive and less obstructive.

Key Takeaways:

  • Empathy in Security Controls: Javvad discusses the importance of understanding users’ needs and challenges. He emphasizes that security should focus on helping users rather than enforcing rigid policies. Using familiar examples, like Tetris vs. Minecraft, he illustrates the shift from a rigid, top-down approach to a more adaptable, user-driven model.

  • Learning from Shadow IT: Rather than forbidding unauthorized tools, Javvad suggests engaging with employees to understand why they choose certain applications. By integrating tools that users find convenient, security teams can balance security with user needs.

  • Behavioral Science Meets Security: Javvad highlights the value of metrics in understanding user behavior and assessing risks. He proposes using a combination of security metrics—like phishing susceptibility and device usage—to gauge an individual’s or department’s security behavior, thereby creating a more effective, user-centric security program.

  • The Power of Nudge Theory: Drawing from behavioral science, Javvad explores how gentle prompts, like password managers and risk reminders, can steer users toward safer behaviors. He likens this to everyday nudges we see, such as speed-limit reminders on roads, which encourage compliance without confrontation.

Resources Mentioned:

About Our Guest:

Javvad Malik is a security awareness advocate and writer at KnowBe4. He uses storytelling and humor to make security concepts relatable and user-friendly. Follow his latest articles on the KnowBe4 blog, where he offers practical insights into security awareness and user-focused security design.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


How to Pick a Whiskey Barrel With The Innocent Lives Foundation Charity

Summary:

Timothy De Block is joined by Shane McCombs and John McCombs of the Innocent Lives Foundation (ILF), Josh Huff and Rev3Dood who volunteer their time with ILF, as they delve into an adventurous and charitable whiskey barrel pick trip from April 2024. This live episode gives an insider’s look into the process of selecting exclusive bourbon barrels and the exciting world of whiskey enthusiasts. From Four Roses to Starlight Distillery, Tim and the team explore unique blends, share laughs, and reflect on how each sip supports a meaningful cause.

Check out Unicorn Auction to place a bid on one of the bottles we’re discussing

Check out the ExploreSec YouTube channel for the live video recording.

In this Episode, You’ll Learn:

  • The Origins of ILF's Barrel Pick Club: Learn about how the passion for whiskey and charity combined to form this unique fundraising avenue for the ILF.

  • The Complexity of Barrel Picking: Discover why selecting a barrel involves more than just a good taste – it requires considering the community’s preferences, uniqueness, and the impact on the ILF mission.

  • Inside Four Roses & Starlight Distilleries: Hear about the in-depth tours, the science of barrel aging, and the behind-the-scenes processes that make these distilleries so iconic.

  • Unique Barrels and Bottles: Highlights include details on Four Roses’ single-tier rickhouses, rare yeast strains, and the exceptional Starlight Mizunara cask, a rarity in the whiskey world.

  • The Auction and Community Impact: John McCombs from ILF explains how the auction supports ILF and offers tips for placing bids on exclusive bottles.

Memorable Moments:

  • Whiskey Tasting: A breakdown of tasting notes for Four Roses and Starlight bottles, featuring everything from minty finishes to complex layers of caramel, chocolate, and spices.

  • Funny Stories: From almost puking in a 15-passenger van to accidental whiskey spills, Tim and the team share some hilarious moments from their trip.

  • Chris Hadnagy’s Unique Taste: Chris’s love for scotch sets him apart as he humorously describes notes like “pine sol” that others struggle to find.

Auction Information: The auction, hosted by Unicorn Auctions, is open for two weeks, and all proceeds go to supporting ILF’s mission. Bids can be placed on unique bottles hand-picked by the ILF team, with Unicorn waiving all fees to maximize impact. Check out the auction site for updates and be ready to place your bids!

Connect with ILF:

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


Exploring Legal Landmines in Incident Response with Thomas Ritter

Summary:

In this episode of Exploring Information Security, host Timothy De Block sits down with Thomas Ritter, a seasoned attorney specializing in cybersecurity and privacy law, to discuss the often-overlooked legal complexities surrounding incident response (IR). From breach terminology to ransomware negotiations, Ritter shares insights from his years of experience navigating legal pitfalls that can arise when responding to security incidents.

Key Takeaways:

  • Understanding "Incident" vs. "Breach": Ritter emphasizes the importance of careful communication within an organization during a security incident. Misusing legally significant terms, like "breach," can lead to premature obligations, such as breach notifications, which may have serious consequences for an organization.

  • Attorney-Client Privilege in IR: External counsel's role can extend attorney-client privilege over critical aspects of IR, including the involvement of forensic specialists. This protection can prove essential if an incident escalates into litigation.

  • Ransomware Negotiation Nuances: With ransomware incidents on the rise, Ritter provides a detailed look at the negotiation process, advising organizations to work with professional negotiators. He recounts instances where attackers leveraged knowledge of clients' cyber insurance coverage to increase ransom demands.

  • Tabletop Exercises for IR Preparedness: Ritter highlights the value of tabletop exercises, especially involving executive leadership. He notes that regular, comprehensive drills help organizations refine incident response policies and minimize legal exposure during actual incidents.

  • Navigating Class Action Exposure: As data breaches often trigger class action lawsuits, organizations must take steps to prepare, including consulting legal professionals to reduce risk through privilege-protected documentation.

Resources Mentioned:

About Our Guest:

Thomas Ritter is a cybersecurity and privacy attorney at Ritter Gallagher, where he focuses on helping organizations navigate the legal landscape of security incidents and data breaches. For more information, or to get in touch, visit RitterGallagher.com or email Thomas directly at thomas@rittergallagher.com.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


[RERELEASE] What is the SANS Holiday Hack Challenge

In this holiday edition of the Exploring Information Security podcast, Ed Skoudis joins me to discuss the SANS Holiday Hack Challenge.

Around this time each year the SANS Holiday Hack Challenge releases under the direction of Ed (@edskoudis) and instructor with the SANS institute. This year Santa has been kidnapped and it’s up to use to figure out who did it and save Christmas. The challenge is for new people in infosec, and for those who have been in the industry for many years. As Ed notes in the episode it is even for children. The challenge itself has been around for years and several past years are still available for people to go through.

In this episode we discuss:

  • What is the SANS Holiday Hack Challenge

  • How it got started

  • What preparation goes into making the challenge each year

  • Who can participate

[RERELEASE] ShowMeCon: What does Jayson E. Street, Dave Chronister, Johnny Xmas, April Wright, and Ben Brown think about security?

In this epic episode of the Exploring Information Security podcast Jayson E. Street (@jaysonstreet), Dave Chronister (@bagomojo), Johnny Xmas (@J0hnnyXm4s), April Wright (@aprilwright), Ben Brown (@ajnachakra), and surprise guests Adrian Crenshaw (@irongeek_adc) and Kevin Johnson (@secureideas)all join me to discuss various security related topics.

ShowMeCon is one of my favorite security conferences. The organizers are awesome and take care of their speakers like no other conference. The venue is fantastic. The content is mind blowing. I can't say enough good things about the even that Dave and Renee Chronister put on every year in St. Louis, Missouri. They know how to put on a conference.

Regular listeners of the podcast will note that I recorded an episode with Dave on ShowMeCon several weeks ago. After that recording he asked if I was interested in doing a recording at the conference. I said yes and thus the birth of this epic episode. This format is experimental. First, it is marked as explicit, because there is swearing. Second, It's over 90 minutes long. I didn't think breaking it up into four or five pieces would serve the recording well. Send me your feedback good or bad on this episode, because I'd like to do more of these. I would really like to hear it for this episode.

In this episode we discuss:

  • Certificates

  • Hiring

  • Interviewing

  • Where to get started

  • Soft skills

  • ShowMeCon and other conferences

  • Community and giving back

  • Imposter syndrome

  • Irongeeks impact on those in attendance

[RERELEASE] What is security awareness?

In the refreshed edition of the Exploring Information Security (EIS) podcast, I talk to Amanda Berlin AKA @Infosystir about security awareness. 

Amanda was charged with setting up a security awareness program for her company from scratch. Setting up a security awareness program is hard work, making it effective is even harder, but Amanda rose to the challenge and came up with some creative ways to help fellow employees get a better handle on security.

In this interview we cover:

  • What is security awareness?

  • How a security awareness program should be implemented.

  • What does an effective security program look like?

  • How do you measure the effectiveness of a security awareness program

How to get a penetration test (pentest)

Summary:

In this episode, Dave Chronister, founder of Parameter Security and ShowMeCon, shares valuable insights into the world of penetration testing (pentesting). Listeners will learn about the differences between vulnerability assessments and penetration tests, what red teaming is, and why organizations should lean towards white-box pentests. Dave and Tim discuss how to avoid common pitfalls when engaging with pentest companies, the importance of rules of engagement, and how to ensure you're getting a high-quality test. Dave also shares stories from his 17+ years in the field, illustrating the critical lessons organizations need to understand.

Key Topics Covered:

  • Difference between vulnerability assessments and penetration tests.

  • Red teaming vs. penetration testing: When and why to use each.

  • How to choose the right pentest company.

  • The importance of setting clear rules of engagement.

  • Real-world examples of pentesting gone wrong.

Resources Mentioned:

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


How to Avoid Election Scams

Summary:

In this timely episode of Exploring Information Security, host Timothy De Block is joined by Pieter Arntz from Malwarebytes to discuss the growing threat of election-related scams. With election season upon us, scammers are becoming more active, and this episode dives deep into how these scams work, what tactics scammers use, and how to protect yourself from falling victim.

You can check out Pieter’s article How To Avoid Election Related Scams at the Malwarebytes blog.

Key Topics:

  • Seasonal Scams: Scams are often timed with key events, including elections, holidays, and tax season. Pieter discusses how scammers shift focus from elections to events like Black Friday or Christmas.

  • Common Election Scams: Scammers often target voters through text messages, social media, and robocalls, attempting to steal personal information or solicit fake donations.

  • Mobile Devices as a Target: With more focus on mobile devices, Android and Apple users are increasingly targeted through phishing texts and malicious links.

  • Social Engineering: Scammers manipulate users by pretending to represent political parties, asking for donations, or engaging in online discussions to steal information.

  • Detecting Scams: Pieter and Timothy offer practical advice on identifying scam messages, such as unsolicited communications, urgency in messaging, and phishing links with suspicious domains (e.g., .xyz, .top).

  • Who’s Behind These Scams?: The episode touches on the actors behind the scams, ranging from cybercriminal gangs to state actors, and how they profit from fraudulent activities.

  • Scams Beyond Elections: While elections are a prime target, natural disasters and other events are also exploited by scammers to steal donations and personal information.

  • Privacy Concerns: A survey revealed that 3% of people are hesitant to vote due to privacy concerns, highlighting the critical need for secure election processes.

Key Takeaways:

  1. Be Wary of Unsolicited Messages: If you receive unsolicited texts or emails, always double-check the source before acting. Election scams often use urgency to push people into making hasty decisions.

  2. Verify Political Donations: Only donate through verified websites. Scammers frequently clone official websites to trick people into giving money to fraudulent causes.

  3. Protect Your Personal Information: Avoid sharing personal details through unofficial or unfamiliar channels. Scammers can use this information for identity theft or phishing attacks.

  4. Report Scams: If you suspect a scam, report it to organizations like the FTC or the FBI to help others stay safe.

Resources Mentioned:

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


What is sober in cyber?

Summary:

In this episode, Jennifer VanAntwerp shares her journey of sobriety and how it inspired her to create the Sober in Cyber community. They discuss the challenges of navigating industry events saturated with alcohol, tips for staying sober, and how the younger generation's attitude towards alcohol is changing. Jennifer also emphasizes the importance of offering alternative options at events and how the sober community is growing in cybersecurity.

Key Topics Covered:

  • Jennifer's personal journey of 23 years of sobriety.

  • The impact of alcohol at cybersecurity conferences.

  • Tips for avoiding pressure to drink at social events.

  • The role of Sober in Cyber in creating inclusive, alcohol-free spaces.

  • How companies can support sober individuals.

Resources Mentioned:

Get Involved:

  • Join the Sober in Cyber Discord community to connect with others in the industry who are sober or looking to reduce alcohol consumption

  • Follow Sober in Cyber on social media for updates on events and community resources

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


How Disinformation Will Impact The 2024 Election with Renee DiResta

Summary:

In this episode, Timothy De Block chats with Renee DiResta about the role of disinformation in elections, particularly as we approach the 2024 cycle. Renee discusses her work in tracking narratives across social media, how state actors like Russia and Iran manipulate public opinion, and the growing importance of platform integrity in identifying inauthentic behavior.

Check out her book Invisible Rules: The People Who Turn Lies into Reality.

Key Topics:

  • The Evolution of Propaganda: How modern disinformation connects to historical propaganda efforts.

  • State-Sponsored Disinformation: Tactics used by Russia, Iran, and China in shaping election narratives.

  • Platform Integrity Teams: How social media platforms now combat disinformation networks.

  • Disinformation Trends: Recurring themes in election-related rumors, such as false claims about voter fraud.

  • The Role of Social Media: How users, not just state actors, influence and spread misinformation.

Recommended Resources:

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


How to Hack an Enterprise

Summary:

In this episode, Timothy De Block and Jonathan Singer dive into the challenges of modern enterprise security. The conversation covers how organizations—using McDonald's as an example—face threats from both digital and physical vectors. They explore how hackers might exploit everything from public Wi-Fi to social engineering tactics and touch on the evolving role of security leaders in dealing with both controllable and uncontrollable risks.

Key Topics:

  • Digital & Physical Attack Vectors: Discussion on hacking tactics such as public Wi-Fi, kiosk vulnerabilities, API exploitation, and social engineering.

  • Security Beyond the Firewall: Why enterprise security involves more than just digital defense—physical security, insider threats, and brand manipulation also pose risks.

  • The Growing Complexity of Security: How new technologies, like IoT devices and AI, are adding layers of complexity to enterprise security.

  • Insider Threats & Social Engineering: The impact of internal threats, from disgruntled employees to social engineering attacks, on large organizations.

Rapid-Fire Hacking Vectors:

  1. Public Wi-Fi

  2. Self-service kiosks

  3. Badge cloning

  4. Typo-squatting for domains

  5. Supply chain dependencies

  6. Insider threats

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


Ben Burkert of Anchor.Dev on the challenges of Internal Certificate Management

Summary:

In this episode, Timothy De Block chats with Ben Burkert about the challenges of managing internal certificate authorities (CAs) and certificates. Ben shares his experiences working with internal CAs at major companies and how those challenges inspired the creation of Anchor.dev.

Key Topics:

  • The Importance of Certificates: Ben explains how certificate mismanagement can lead to outages and business interruptions, and why automation is crucial.

  • TLS and ACME: Understanding how TLS secures communications and how ACME clients automate certificate management.

  • Anchor.dev: A cloud service that simplifies internal CA management and helps companies secure their internal networks with automated renewals and distribution.

  • LCL Host: A tool from Anchor.dev that enables HTTPS in local development environments, improving deployment workflows.

Links:

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


[RERELEASE] What is Practical Web Applicaiton Penetration Testing?

This is the last week to register for Tim’s class in 2024 - go to https://www.practisec.com/events/ to get signed up.

In this educational edition of the Exploring Information Security podcast, Tim Tomes joins me to discuss Practical Web Application Pentration Testing (PWAPT) training.

Tim (@LaNMaSteR53) is one of the leading names within the application security field. A former instructor for many organizations, he wanted to do more with training. He wanted to provide attendees to training with more hands on work. Get into an application, exploit it, and then provide remediation steps. He came up with the PWAPT training.

In this episode we discuss

  • How the idea for the training came about

  • Why the training is important

  • Who should attend the training

  • What makes this training unique

[RERELEASE] How to find vulnerabilites

In this susceptible edition of the Exploring Information Security podcast, Samy Kamkar joins me to discuss how to find vulnerabilities. This is a RERELEASE EPISODE.

Samy (@samykamkar) shouldn't need too much of an introduction to most people. He's been in the news for hacking garage doors, credit cards, cars, and much much more. Samy likes to hack things and has a knack for finding vulnerabilities in everything from locked machines to wireless doorbells. His site has the full list of vulnerabilities as well as videos and press appearances. Which made him the perfect guess for talking about how to find vulnerabilities.

In this episode we discuss:

  • What got him started in looking for vulnerabilities

  • What is a vulnerability

  • What skills are necessary for finding vulnerabilities

  • How he decides his next project

  • The steps to finding vulnerabilities

  • What he does when he discovers a vulnerability

  • How long the process takes

The Origins of Risky Business with Patrick Gray

Summary:

Patrick Gray, the host of the Risky Business podcast, shares how he transitioned from a tech journalist to a leading voice in cybersecurity podcasting. Patrick discusses the origins of his podcast, the evolution of his content, and how he maintains integrity with sponsors. He also offers advice for aspiring podcasters on focusing on the audience and using the right tools.

Key Topics:

  • The unexpected inspiration behind Risky Business.

  • Moving from general tech journalism to focused security content.

  • The importance of understanding technical details in reporting.

  • The growth of the Risky Business team and their venture into video content.

  • Navigating sponsorships while maintaining editorial independence.

  • Advice for new podcasters: prioritize your audience and use the right tools.

Resources:

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


How to Navigate a Career in Cybersecurity

Summary:

In this episode, Timothy De Block sits down with Ralph Collum, a cybersecurity educator with over a decade of experience in the field. They delve into Ralph's career journey, discussing his transition from a chemist to a cybersecurity professional and the various roles he's taken on, including server administration, auditing, and penetration testing. Ralph shares insights on the importance of soft skills, continuous learning, and the evolving landscape of cybersecurity.

Key Topics Discussed:

  • Ralph’s Career Journey

  • The Impact of the Pandemic on Cybersecurity Groups

  • Getting Into Cybersecurity

  • The Role of Soft Skills in Cybersecurity

  • The Impact of AI on Cybersecurity Careers

  • Resources and Recommendations

Resources Mentioned:

  • Books:

    • The Code to the Dead Cow Joseph Menn

    • Spam Nation by Brian Krebs

    • The Art of Invisibility by Kevin Mitnick

    • Social Engineering: The Science of Human Hacking by Christopher Hadnagy

  • Websites:

    • Help Net Security

    • Bleeping Computer

    • Hacker News

    • Dark Reading

  • Tools:

    • Feedly for organizing cybersecurity news

    • TryHackMe and Hack The Box for practical labs

Connect with Ralph Collum:

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


SIM Swapping: How Worrying is it in 2024?

Summary:

Episode Summary: In this exchanged episode, Timothy De Block chats with Mubix about the intricacies of SIM swapping, an attack vector that has seen significant attention. They discuss the current state of SIM swapping, how attackers exploit this technique, and the measures carriers have implemented to mitigate these risks. Mubix highlights the importance of understanding your risk profile and the practical steps organizations and individuals can take to protect themselves.

Key Topics:

  • The evolution and difficulty of executing SIM swapping attacks.

  • Real-world examples and the misclassification of SIM swapping incidents.

  • The impact of enhanced carrier protections and the role of user awareness.

  • The distinction between SIM swapping and other forms of social engineering.

  • Practical advice for businesses and high-risk individuals to safeguard against SIM swapping.

Discussion Points:

  • SIM swapping detection and reporting procedures.

  • The role of eSIMs and potential security concerns.

  • The importance of proactive security measures and user empowerment.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]