Joining us this week is Jason Steer, principal security strategist at Recorded Future. Our conversation centers on the state of threat intelligence in a rapidly changing security environment, how organizations are adapting and evolving their threat intelligence strategies, as well as Jason Steer’s outlook on some of the security challenges professionals are likely to face in the year ahead.

Rick Howard has enjoyed a distinguished career in cybersecurity, including time in the U.S. Army and as chief security officer at Palo Alto Networks. These days, I’m proud to call Rick my colleague at the CyberWire, where he serves as our chief security officer and chief analyst.  Rick Howard is also creator of the podcast series CSO Perspectives, where he explores the wide spectrum of issues facing chief security officers. In an early season of that show, Rick focuses on the notion of first principles, the foundational notions on which our fundamental security ideas and beliefs rest. Rick Howard joins us this week for an overview of first principles — what it means, how to implement it, and how to convince the powers that be in your organization that it’s the right thing to do.

Like most emerging technologies, artificial intelligence can be used for good or bad, depending on who’s using it, their intentions and how they apply it. There can also be unintended consequences, which presents policy makers with challenges when trying to apply guard rails to things like AI.    Our guest today is Megan Jacquot. She’s an associate cyber security threat intelligence analyst at Recorded Future. On today’s episode, Megan describes her work with international non profit ForHumanity, and how they aim to be an informed source for policy makers who are setting the rules of the road on the future internet.

Our guest this week is Jeremy Blackthorne, president of the Boston Cybernetics Institute. They provide a variety of cybersecurity services, and our conversation focuses on their unique approach to training, specifically for members of the U.S. military. Jeremy served in the U.S. Marine Corps, and we explore the advantages that provides when approaching both training and operational security issues. We’ll get his take on threat intelligence, as well.

Our guest this week is Nico Dekens. Online, people know him as the “Dutch OSINT Guy,” a handle he’s earned through his extensive knowledge and background in open source intelligence.  Nico shares his own history getting into the field, as well as some real-world examples of how he goes about gathering OSINT, and how individuals can do a better job protecting themselves online. And, of course, we’ll get his insights on threat intelligence as well.

Our guest this week is Steven Atnip. He’s a senior advisor for Verizon’s threat research advisory center and the dark web hunting team. Steven shares his early career experience in the U.S. Navy and explains why he believes the military provides unique opportunities for people looking to launch their careers. We’ll hear his views on the importance of company culture, being a lifelong learner, how to step up to challenges of an organization running at scale, as well as his insights on security and threat intelligence. We caught up with Steven Atnip at Recorded Future’s RFUN: Predict 2019 conference in Washington, D.C.

Our guest this week is Daniel Cuthbert. He’s the global head of cybersecurity research for Banco Santander, and he sits on both the Black Hat review board and the Black Hat training board. Our conversation centers on his work in the financial industry, his unusual path to cybersecurity, and his thoughts on creative diversity. We get his take on threat intelligence, as well as his insights on team leadership and seeking a career in security.

Joining us this week is Espen Johansen, operations and security manager at Visma, an information technology and services company headquartered in Oslo. He shares insights on the types of attacks he sees targeting organizations like Visma, and the lessons learned from a nation-state attack Visma experience in August 2018. He’ll give us his take on threat intelligence, as well as advice for organizations looking to just beginning their threat intelligence journey. We sat down with Espen Johansen at Recorded Future’s 2019 RFun Predict conference in Washington DC.

Our guest this week is Edward Davis. He’s president and CEO of The Edward Davis Company, a business strategy and security services firm, but he is perhaps best known for his role as former police commissioner for the city of Boston — a role he held during the tragic Boston Marathon bombing in 2013. In the aftermath of that event, he was the face of the city, as his team coordinated and collaborated with other local and national law enforcement agencies. We discuss his experience with the Boston Marathon bombing, get his insights on law enforcement in the age of ransomware, and hear his thoughts on the role of threat intelligence. Joining this episode’s conversation is Recorded Future’s Allan Liska.

Booking.com is one of the leading travel booking sites in the world, facilitating over one and a half million room nights via their platform every day. With that many clients, in addition to a network of third-party suppliers and partners around the world, Booking.com successfully fends off more than their fair share of attempted attacks. Our guests today are two members from Booking.com’s security team who work every day to help protect the organization — Anastasios Pingios, principal security engineer, and Stuart Shevlin, intelligence program lead. We caught up with Anastasios and Stuart at Recorded Future’s RFUN: Predict 2019 conference in Washington, D.C.

Our guest today is O’Shea Bowens. He’s CEO of Null Hat Security and a SOC manager for Toast, a Boston-area firm, where he focuses on threat hunting, incident response, SOC operations, and cloud computing. O’Shea shares his early beginnings as a teenage hacker learning the ropes, his career path, and why he believes it’s important to be a role model, a mentor, and to have a presence in the security community.

If you are of a certain age — an age where you may have spent a good bit of your time online using Myspace — you may recall an incident with the Samy worm, which in 2005 spread through Myspace so quickly and uncontrollably that they had to temporarily shut the service down to regain control. It was, by all accounts, a prank that got out of hand, but the authorities were not amused, and Samy Kamkar, who wrote the worm, was eventually sentenced to probation, community service, and a hefty fine. Since then, Samy Kamkar has set his sights on security research, with a specific focus on open source software. We caught up with Samy at Recorded Future’s RFUN: Predict 2019 conference in Washington, D.C., where he was delivering one of the keynote presentations.

Our guest today is Syra Arif, a senior advisory solutions architect in the security and risk practice at ServiceNow, a global cloud computing company. Syra shares her insights on providing customers with solutions to the business challenges of governance, risk, and compliance. She shares her experience coming up through the industry as a woman, and we also get her perspective on threat intelligence and why it’s critical for organizations to embrace diversity.

Recorded Future’s Insikt Group recently discovered a new Canada-focused darknet marketplace called WeTheNorth. This localized criminal marketplace features a variety of illegal goods and services for sale, many of which pose a threat to local and global enterprises. WeTheNorth administrators have gone to great lengths to create a marketplace geared toward protecting Canadian buyers and sellers and fostering a relatively safe place to complete transactions. On this week’s episode we welcome back Recorded Future threat intelligence analyst Charity Wright to provide insights on WeTheNorth and the techniques she and her colleagues used to analyze the group.

As organizations become increasingly complex in their push for digital transformation, the need for actionable, automated threat intelligence for everyone has never been greater. On this week’s show, we tackle that very topic with Recorded Future’s chief of intelligence solutions, Stuart Solomon. We caught up with Stuart at Recorded Future’s RFUN: Predict 2019 conference in Washington, D.C. to discuss threat intelligence, the notion of security intelligence, and some practical considerations for integrating these kinds of tools.

Cities and municipalities have made headlines recently in their efforts to defend themselves from cyber attacks, most notably ransomware. Joining us this week to discuss the unique security challenges faced by municipalities are two guests. Margaret Byrnes is Executive Director of the New Hampshire Municipal Association, a non-profit membership organization that provides education, training, advocacy and legal services to cities and towns across New Hampshire. Joe Howland is Chief Information Security Officer at VC3, a managed IT services company who’s clients include many municipalities throughout the country.

Our guest this week is Jöerg Schauff. He’s a principal consultant at Symantec, focusing on cyber and threat intelligence. He shares his insights on the challenges he sees his clients facing in Germany and how their experiences inform proper defenses internationally. We’ll discuss the differences between run-of-the-mill thieves and nation-state threat groups, as well as how organizations can best make use of threat intelligence and set themselves up for success.

Our guest this week is Quiessence Phillips, deputy CISO and head of threat management for New York City Cyber Command. She’s one of the leaders of a team of cybersecurity professionals working to strengthen and coordinate the cyber defenses of one of the largest and most important cities in the world. Quiessence joins us to share valuable insights into managing the scale of the responsibilities she and her team hold, the techniques she advocates for staying ahead of threats, as well as her thoughts on how best to prepare for a position in the industry.

On this week’s show, we welcome back Lauren Zabierek. The last time she joined us, she was a senior intelligence analyst at Recorded Future, but she’s since taken on the role of director of the cybersecurity project at Harvard’s Belfer Center. She shares the mission of her organization, the role she thinks it has to play on the national and international stage, and why making sure everyone has a seat at the table leads to better, safer outcomes.

Our guest today is Rosa Smothers, senior vice president of cyber operations at KnowBe4, where she leads KnowBe4’s federal practice efforts, including providing cybersecurity advisory services to civilian and military agencies within the U.S. federal government. From her humble beginnings with a used 8-bit home computer, Rosa’s career experience includes over a decade in the CIA, leading cyber operations against terrorists and nation-state adversaries. She served multiple tours overseas as a cybersecurity analyst and technical intelligence officer in the Center for Cyber Intelligence and the Counterterrorism Mission Center, and was highly decorated for her service. She’s a strong advocate and mentor for women starting their careers, and is a member of Women in Defense and InfraGard.

Disinformation campaigns are in the news. Starting with the 2016 U.S. election cycle, continuing in 2018, and now looking ahead to 2020, the threat of online influence operations from foreign adversaries has been top of mind — but there’s a different kind of disinformation for sale on the dark web. Researchers from Recorded Future’s Insikt Group engaged with two threat actors selling their wares on Russian-speaking underground forums. They discovered that disinformation campaigns are readily available, not terribly expensive, and potentially highly effective. Roman Sannikov is director of analyst services at Recorded Future, and he shares what they found.

When we talk about threat intelligence, we often put it in the context of bringing information to the surface, creating context and alerts to let you know what you need to be concerned with. We also speak of cutting through the noise, of pulling the signal out and transforming it into actionable intelligence. Our guest today is Andrew Morris. He’s CEO of GreyNoise Intelligence, a company that describes itself as “anti-threat intelligence.” That’s not to say they’re against threat intelligence — quite the opposite, in fact — but instead of focusing on what should keep you up at night, Andrew and his team analyze the background noise of the internet to determine what you don’t need to worry about. It’s a unique approach that’s perhaps a bit counterintuitive at first, but ultimately, they say it helps you filter out useless noise and focus your time and resources on what really matters.

There has been a growing number of ransomware attacks targeting cities and towns across the U.S. Once hit, cities and towns face a number of tough decisions — pay the ransom, restore from backup — and all of this happens with a backdrop of needing to provide vital services to citizens. To add insult to injury, many cities and towns face tight IT and security budgets. They’ve been asking for more security and better backup tools, but are quite often being told that the money is simply not there. Recorded Future’s Allan Liska knows a thing or two about ransomware. He’s co-author of the book, “Ransomware: Defending Against Digital Extortion,” and he recently published the results of some ransomware research that he and his team at Recorded Future have been working on. He’ll share their findings, along with advice for keeping your organization safe.

Our guest today is Matt Devost. He’s CEO and co-founder of OODA LLC, a company that helps clients identify, manage, and respond to global risks and uncertainties. Matt Devost has been at the intersection of public policy and cybersecurity since it became possible to align the two. He has expertise in counterterrorism, critical infrastructure protection, intelligence, risk management, and cybersecurity issues.  In addition to sharing the story of his career journey, we’ll get his insights on managing cyber risk in a complex world, as well as his thoughts on threat intelligence.

Our guest this week is Harry Kemsley. He’s president of national security and government at defense intelligence organization, Janes. Prior to joining Janes, he spent 25 years in the Royal Air Force.  Harry Kemsley is author of a recent opinion piece published in The Hill, titled In OSINT we trust? In it, he makes the case that many intelligence organizations around the world would do well to increase their use of open source intelligence. To do that, there are cultural issues regarding the reliance on classified sources that may need to be overcome, but in the end, he believes the benefits are worthwhile.

Our guest today is Josh Kamdjou. He’s co-founder of Sublime Security, a company that’s looking to address the widespread security issues of phishing and spearphishing by offering open source tools that alert users to a range of potential indicators, as well as giving users the opportunity to share their findings with the community, to more quickly spread the word about new and growing threats.  We’ll learn about his career journey, get his thoughts on threat intelligence, and hear his advice for folks looking to enter the field.

Recent protests in Hong Kong have highlighted a growing trend in online influence operations, in this case from mainland China. Officials there have been using Western social media platforms to influence public perception of the Hong Kong protests. Those social media platforms have, in turn, shut down accounts they’ve determined are posting what they call “inauthentic content.”  Researchers in Recorded Future’s Insikt Group have been analyzing these attempts at online influence operations and have published a report titled “Chinese State Media Seeks to Influence International Perceptions of Hong Kong Protests.” Priscilla Moriuchi is head of nation-state research at Recorded Future, and she joins us to share their findings.

Our guest today is Cody Cornell. He’s CEO of Swimlane, a SOAR platform provider. Cody began his career in the U.S. Coast Guard and has spent 15 years in IT and security, including roles with the U.S. Defense Information Systems Agency, the Department of Homeland Security (DHS), American Express, and IBM Global Business Services. We’ll learn about his career path from sailor to CEO, he’ll share his insider perspective on SOAR platforms and how organizations are using them, and we’ll learn about how he thinks organizations are best implementing threat intelligence to protect not just themselves, but the community as a whole.

Our guest today is Larci Robertson. She’s a senior manager in cyber threat intelligence at Epsilon, a marketing and advertising firm in Irving, Texas. Larci got started in threat intelligence right after college when she joined the U.S. Navy, back before the term “threat intelligence” had been coined. She eventually left the service and worked with a number of defense contractors, before moving to the private sector as a senior cyber threat analyst at PepsiCo, and ultimately to her current position with Epsilon. She shares her career journey, her strategies for protecting her organization and managing resources, and her insights from nearly two decades in the threat intelligence business.

Our guest today is Monzy Merza. He’s the VP and head of security research at Splunk. He shares his journey into tech and security, including leadership positions in both the government and private sectors, his thoughts on threat intelligence and the maturity companies need to properly implement it, as well as his perspective on the current state of SIEMs, and how they’ll need to evolve to keep up with the changes happening in the industry and the world at large.

Our guest is John Moran, senior product manager at DFLabs, whose offerings include a SOAR platform for cybersecurity. John shares his career journey from public safety to digital forensics and cybersecurity, his thoughts on some of the benefits and misconceptions surrounding SOAR deployment, insights on threat intelligence, and much more.

Our guest is Jason Bernier. He’s a penetration tester, working to help organizations ensure their systems are secure, and helping them understand where their weaknesses may be. He’s got some insightful stories to share from his work, along with practical advice for folks looking to find their place in the industry. To be sure, it’s serious work, but there’s no question Jason is passionate about his job, and he has a good time doing it.

Criminal markets on dark web forums are the online version of a bad neighborhood, complete with sellers, buyers, and people who make their living connecting those groups. They tend to be self-policing, and so when an individual discovers a fundamental flaw in the technical foundation of the community and then decides to take advantage of that flaw to hold entire markets for ransom, that tends to get people’s attention. It’s a high-stakes game. Daniel Byrnes is a senior threat intelligence analyst with Recorded Future’s Insikt Group, and he found himself on a journey down a dark web rabbit hole to try to make sense of the situation.

Our guest today is Micah Hoffman. He’s principal consultant at Spotlight Infosec, and one of the founders of the OSINT Curious web site, an online destination for enthusiasts and students of open source intelligence gathering and analysis techniques. He shares his professional journey from psychology to information security, his insights on the growing availability and important of open source intelligence, his emphasis on ethics, and how organizations can best integrate open source tools into their security strategies.

Researchers at Recorded Future have recently detected and described a new kind of influence operation that they’ve named “Fishwrap.” The technique involves recycling previously published news accounts of terrorist activities and amplifying their exposure through social media, with the apparent intent of sowing the seeds of distrust and unease. Our guest today is Staffan Truvé, CTO and co-founder of Recorded Future. He’ll describe the tools they used to uncover the Fishwrap campaign, the conclusions they’ve reached from the information they’ve gathered, and the ways we can all prepare ourselves to spot them.

Our guest this week is Kimberly Grauer. She is the director of research at Chainalysis, where she examines trends in cryptocurrency economics and crime.  Kimberly Grauer joins us with insights on the state of cryptocurrency around the world, the cultural and regional considerations that play into adoption by individuals, organizations and governments, and where she thinks things are headed. 

Our guest today is Tracy Maleeff. Before earning a position as a cyber analyst at a Fortune 500 company, she ran her own firm, providing information security and competitive intelligence research. Prior to that she worked as a Library Resources Manager for a major law firm. Tracy shares the story of her unusual career journey from library science to cyber security, her advice for getting up to speed after a mid-career course change, as well as her thoughts on team building and the importance of diversity throughout an organization.

The NIST Cybersecurity Framework has become a valuable tool for evaluating security across a variety of business sectors. Originally published in 2014 and targeting critical infrastructure, the framework continues to evolve to meet the changing needs of organizations in the U.S. and around the world. Its popularity stems from its thoroughness, applicability, and approachability. Our guests today are Ken Durbin, senior strategist for global government affairs and cybersecurity at Symantec, and Allan Liska, senior solutions architect at Recorded Future. They’re going to walk us through the NIST Cybersecurity Framework and help us understand how to make the most of it within our own organizations.

Joining us today is John TerBush, senior threat intelligence researcher at Recorded Future. John is an instructor with the SANS Institute, currently teaching a course on open source intelligence that he helped develop. Before joining Recorded Future, he was a senior cyber threat intelligence analyst and subject matter expert with consulting firm Booz Allen Hamilton’s Cyber4Sight, and before that he worked for Symantec as a security operations center analyst. Earlier in his career, he worked as a researcher and private investigator. Our conversation explores the value proposition of threat intelligence, and how organizations can dial in how they use it to manage risk, keep their business leaders informed, and get the best bang for their cybersecurity buck.

Our guest today is Tanya Janca. She’s a senior cloud advocate at Microsoft, where she specializes in application security. She’s a popular speaker at security conferences around the world, evangelizing software security and advocating for developers. And she’s a leader in the Open Web Application Security Project (OWASP) community, as well as an advocate and mentor for underrepresented communities in the security industry. She discusses her journey from software developer to security practitioner, how “security is everybody’s job” and why that makes strong communication between teams so important, and the need for diversity in the IT industry today.

Threat Intelligence is a wide ranging term, and it can mean different things to different people as they consider the variety of ways to best integrate it into their organization’s cyber defense strategies. In today’s show, we’re exploring the possibilities for leveraging threat intelligence throughout your organization, from the SOC to the board room, from incident response to fraud protection, and much more. Joining us to guide our journey is Recorded Future’s Mike Petronaci. Before joining Recorded Future, Mike spent time working in the U.S. Department of Defense, as well as with industry leading organizations like Akamai and Cybereason.

Our guest today is Niloofar Razi Howe. She’s a respected technology executive, entrepreneur, board member and investor, having served as Chief Strategy officer for Endgame and, later, RSA Security. She’s a life member of the Council on Foreign relations, and a Recorded Future board member. Our conversation touches a range of topics, from her start as an attorney and entrepreneur, her shift to venture capital, and her executive level assignments as chief strategy officer. We’ll get her take on where she thinks the VC money will be headed in cyber security, as well as her thoughts on why it’s important to make time for giving back.

Our guest today is Martijn Grooten. He’s editor at Virus Bulletin, an online forum for sharing the latest cybersecurity research and intelligence, which dates back to 1989. They’re also an independent testing and certification body, and they hold a popular international security conference annually. Our conversation spans a range of topics, including the evolution of threats that Martijn has tracked over the past several decades, the current state of malicious email campaigns, why he believes some organizations overstate the potential impact of nation-state attacks, his thoughts on threat intelligence, and his recommendations for how organizations can best protect themselves.

In this episode, we check in with Recorded Future’s Levi Gundert and Allan Liska for a refresher on threat intelligence, including how they have come to describe it and why some people have a hard time wrapping their heads around what, exactly, it is and is not. We’ll find out whether threat intelligence is for everyone, and if so, how organizations of different sizes can best engage and make use of actionable threat intelligence. And we’ll learn how combining the strengths of human analysts with the capabilities of state-of-the-art machine learning provides the best of both worlds.

StubHub is the world’s largest ticket marketplace, where buyers and sellers of tickets for sports, concerts, theater, and other live entertainment events connect and do business. They partner with over a hundred entertainment venues and sports teams, enabling the exchange of hundreds of millions of tickets each year. With all of that money flowing through their system, they naturally attract their share of fraudsters. One of the people on the front lines protecting StubHub and their users is Sandeep Abraham, StubHub’s only combination threat analyst and investigator. He joins us this week to describe the challenges StubHub faces and how he uses a unique approach of empathy and emotional intelligence, alongside more straightforward threat hunting techniques, to stay one step ahead of the fraudsters.

Our guest today is Brian Haugli. He’s a partner at Side Channel Security, a consulting firm in the Boston area. Prior to forming Side Channel Security, he was chief security officer for The Hanover Insurance Group. Earlier in his career, he held civilian leadership positions at the Pentagon, helping organizations in the Department of Defense implement cybersecurity best practices. Today, he helps organizations of all sizes to evaluate their security using a risk-based approach, while taking advantage of his own expertise in threat intelligence implementations and strategic organizational initiatives.

Ransomware threat actors continue to make their way into systems of organizations big and small all over the world, leading to business interruptions, financial loss, and reputational damage. Even more troubling are recent reports attributing loss of life to ransomware attacks on medical facilities.    Our guest this week is Recorded Future threat intelligence analyst Dmitry Smilyanets. He brings his experience and unique insights to the conversation, with the latest tactics, techniques and procedures he and his colleagues are tracking from ransomware operators. 

Joining us today is Dana Pickett. He’s CISO for Edwards Performance Solutions, as well as a principal for the cybersecurity services they offer. With over three decades in the industry, Dana has witnessed the inception and evolution of cybersecurity, from mainframes to the IoT. He shares his thoughts on what it takes to be a successful CISO, the importance of focusing on business outcomes, effective communication with the board, proactive versus reactive threat intelligence, the utility of frameworks, and the value of peer groups.

Our guest today is Michelle Dennedy. She’s vice president and chief privacy officer for Cisco. An outspoken advocate for building technologies that not only enhance our lives but also promote integrity and respect for people regardless of their level of technical sophistication, Michelle is leading the charge for better understanding and implementation of privacy and data security policies around the world. Our conversation includes her thoughts on why organizations find privacy so challenging, the differences between aspirational messaging and foundational values, and where she thinks the next generation of security and privacy professionals may take us.

Our guest today is Brian Martin, vice president of vulnerability intelligence at Risk Based Security, a company that provides risk identification and security management tools leveraging their data-breach and vulnerability intelligence. Brian shares his experience turning data into meaningful, actionable intelligence, common misperceptions he’s encountered along the way, and why he thinks companies shopping around for threat intelligence need to be careful to ask the right questions.