Season 2, EP 4
Déjà Vu: Uncovering Stolen Algorithms in Commercial Products
July, 2022 | Paul Roberts
We chatted with Black Hat Speaker Patrick Wardle who joined us to talk about unauthorized algorithm use.
Cyber Content Lead at ReversingLabs. Paul is a reporter, editor and industry analyst with 20 years’ experience covering the cyber security space. He is the founder and editor in chief at The Security Ledger, a cybersecurity news website. His writing about cyber security has appeared in publications including Forbes, The Christian Science Monitor, MIT Technology Review, The Economist Intelligence Unit, CIO Magazine, ZDNet and Fortune Small Business. He has appeared on NPR’s Marketplace Tech Report, KPCC AirTalk, Fox News Tech Take, Al Jazeera and The Oprah Show. You can find Paul online on Twitter (@paulfroberts and on LinkedIn).
Watch Episode
Season 2, EP 3
Not All Developers Can Be Security Jedis
July, 2022 | Paul Roberts
We chatted with Black Hat Speaker Adam Shostack about the need for better developer training.
Season 2, EP 2
IconBurst - The Newest Software Supply Chain Attack
July, 2022 | Paul Roberts
We chatted with ReversingLabs Reverse Engineer Karlo Zanki about how he discovered IconBurst.
Season 2, EP 1
Smash and Grab - AstraLocker Breach
July, 2022 | Paul Roberts
We chatted with ReversingLabs Malware Researcher Joseph Edwards about his research on AstraLocker 2.0.
Season 1, EP 8
Bryson Bort of Scythe.io talks about the Colonial Pipeline attack and the lessons learned from the crippling ransomware attack a year ago
June, 2022 | Paul Roberts
Bryson Bort is a cybersecurity industry leader with experience in both the public and private sectors. He is the founder and CEO of Scythe.io, which performs high-level vulnerability assessments. He is also the co-founder of the ICS Village, a non-profit organization that builds critical infrastructure (CI) and presents it at various conferences. The non-profit also offers guidance and resources for IT practitioners.
Bort’s experiences made him the perfect fit to moderate a highly anticipated session at this year’s RSA Conference in San Francisco: Colonial Pipeline - What Happened, What Changed, featuring panelists from government, the media, and the fuel industry. ConversingLabs podcast host Paul Roberts checked in with Bort during this year’s conference to talk about the panel discussion, and the lessons learned from the Colonial Pipeline incident - including the need for closer scrutiny of critical infrastructure and the limits of voluntary, industry-driven standards for cybersecurity.
Season 1, EP 7
Steve Lipner of SAFECODE on Supply Chain Security - Is It Even Possible?
June, 2022 | Paul Roberts
When it comes to secure software development, Steve Lipner is one of those information security industry leaders who was there at the creation, so to speak. Lipner, the current Executive Director of the non-profit SafeCode, served as the Director of the Microsoft Security Response Center (MSRC) and from 2004 to 2013 - a critical period that saw Microsoft launch the now renowned Security Development Lifecycle (SDL) initiative, which Lipner oversaw. As part of SafeCode, Lipner has worked to promote secure development principles more widely in industry. SafeCode provides free resources on secure software development as well as advice and recommendations for development organizations in the form of white papers, blog posts, social media posts, and more.
ConversingLabs host Paul Roberts chatted with Lipner as a part of our ConversingLabs Cafe series of chats at the recent 2022 RSA Conference in San Francisco.
In this conversation, Lipner explains what secure software is, recounts his own experiences on Microsoft’s Software Security Development Lifecycle Team at as the point of the spear in Microsoft’s Trustworthy Computing Initiative. Lipner stresses that secure software must come from within (so to speak). Outside consultants may be able to promote best practices, but they will never be able to grasp what needs fixing as well as members of your own development team. That’s why an organization’s developers need to be trained and motivated to write secure code, which means seeing mistakes as they write code and throughout the entire development process.
Lipner also talks about the Biden Administration’s Executive Order (EO) on Improving the Nation’s Cybersecurity, released in May 2021. Lipner believes that the impact of the EO is still a work in progress. He noted that Safe Code’s member companies have made it a priority to demonstrate that they are meeting the requirements set forth in the EO. He’s particularly a “fan” of Section 4 of the EO, which lists the requirements for a robust software security program.
Season 1, EP 6
Robert Martin of MITRE on Supply Chain System of Trust
June, 2022 | Paul Roberts
MITRE, the non-profit corporation, has been instrumental in developing systems to help with issues related to software assurance. That includes the development of CVEs (Common Vulnerabilities and Exposures) and CWEs (Common Weakness Enumeration) not to mention the ATT&CK taxonomy of adversarial methods.
Now MITRE is taking things further and “stepping up into the organization” to focus on supply chain risk, according to Robert Martin, a Senior Principal Engineer at MITRE. COVID has highlighted supply chain risks - whether its availability, counterfeit products or - of course - cyber risk, he said. But solving supply chain problems is not simply a job for the IT group, but something that needs to be driven from the very top echelons of an organization.
His organization published a framework in early 2021 called the System of Trust (sot.mitre.org), which provides a framework for supply chain security risk assessments that is customizable, evidence-based, scalable and repeatable. Once implemented, the SoT will give organizations within the supply chain confidence in each other as well as different service offerings and supplies.
Martin sat down with ConversingLabs host Paul Roberts on the sidelines of the RSA Conference in early June.
In this conversation, he talks about how the software supply chain is highly complicated, due to an increasing number of things in society becoming cyber-enabled.
Martin explained how software is not written neatly end to end, but rather is built with drivers, dependencies, and frameworks that give the supply chain depth and magnitude. If software practitioners are not given visibility into this complicated picture, they will miss the software supply chain risks that pose a threat to their organizations.The SoT’s goal is to promote transparency, allowing developers to see all of the players in the supply chain.
Check out the full conversation with Martin below!
Season 1, EP 5
Dependency Confusion As A Tool For Targeted NPM Hacks
May 11, 2022 | Paul Roberts
We chatted with ReversingLabs Reverse Engineer Karlo Zanki about how NPM packages have been caught serving malware via compromised software updates.
Season 1, EP 4
Local Threat Intel - You're Soaking In It!
April 27, 2022 | Paul Roberts
We chatted with ReversingLabs’ very own Hrvoje Samardžić and Independent Malware Hunter Luigi De Mori/JAMESWT (@JAMESWT_MHT) about what kinds of internal threat intelligence are the most useful, where to find it, and how to leverage this data to improve your organization’s defenses.
Season 1, EP 3
Emotet Unbound: Understanding the Risk
April 13, 2022 | Paul Roberts
In this podcast, we dig deep on the Emotet malware with two noted experts: Dado Horvat of ReversingLabs and Dragan Damjanovic of KPMG and talk about the evolution of the threat and the latest Emotet IOCs.
