The Security Swarm Podcast – Détails, épisodes et analyse

Détails du podcast

Informations techniques et générales issues du flux RSS du podcast.

The Security Swarm Podcast

Hornetsecurity

Technologie

Actualités

Fréquence : 1 épisode/8j. Total Éps: 71

Welcome to The Security Swarm Podcast – a weekly conversation of the most critical issues facing the world of cybersecurity today, hosted by Andy Syrewicze, Security Evangelist at Hornetsecurity. From the malicious use of AI tools to social engineering scams, each episode hones in on a pertinent topic dissected by an industry expert and backed up by real-world data direct from our Security Lab. The world of cybersecurity should not be taken on alone – it’s time to join the swarm.

Lire plusRéduire

Site

RSS

Apple

Classements récents

Dernières positions dans les classements Apple Podcasts et Spotify.

Apple Podcasts

🇨🇦 Canada - technology
29/09/2024
#81

Spotify

Aucun classement récent disponible

Liens partagés entre épisodes et podcasts

Liens présents dans les descriptions d'épisodes et autres podcasts les utilisant également.

https://www.linkedin.com/in/asyrewicze/
27 partages
https://www.linkedin.com/in/paulschnack/
9 partages
https://www.linkedin.com/in/umut-alemdar/
8 partages

https://www.twitter.com/asyrewicze
26 partages
https://twitter.com/paulschnack?lang=en
7 partages
https://www.twitter.com/ericsiron
4 partages

Qualité et score du flux RSS

Évaluation technique de la qualité et de la structure du flux RSS.

Qualité du flux RSS

À améliorer

Score global : 52%

Historique des publications

Répartition mensuelle des publications d'épisodes au fil des années.

Year

Derniers épisodes publiés

Liste des épisodes récents, avec titres, durées et descriptions.

Top Spear Phishing Methods

Épisode 63

vendredi 27 septembre 2024 • Durée 34:19

In this episode of the Security Swarm Podcast, host Andy Syrewicze and guest Romain Basset dive into the top spear phishing methods used in both the enterprise space and across all businesses, based on internal research conducted by Hornetsecurity.

The conversation covers spear phishing techniques, including initial contact, tax/W2, C-suite/CEO, lawyer, banking, and gift card fraud. They analyze the differences in the prevalence of these methods between enterprises and smaller businesses and provide insights on how organizations can combat these threats through training and robust processes.

Do you want to join the conversation? Join us in our Security Lab LinkedIn Group!

Key Takeaways:

Spear phishing attacks have evolved from obvious wire transfer requests to more subtle techniques like initial contact fraud, where threat actors establish a relationship to build credibility.

Tax fraud and W-2 phishing remain prevalent, especially around tax season, as attackers try to obtain personal information like Social Security numbers.

C-suite fraud, where attackers impersonate executives, continues to be a major threat, highlighting the importance of robust processes to verify requests.

Lawyer fraud, targeting enterprises more than smaller businesses, leverages the credibility of legal communications to extort money or gather information.

Gift card fraud has emerged as the top spear phishing attack across enterprises and smaller businesses, as it is less likely to raise red flags than larger financial transactions.

Adaptability and creativity of threat actors are key factors, as they continuously evolve their techniques to bypass security measures and user awareness.

Timestamps:

(03:26) Discussion on initial contact fraud

(07:12) Exploration of tax fraud and W-2 phishing

(13:35) Examination of C-suite fraud and the importance of processes

(19:25) Lawyer Fraud and Enterprise vs. SMB Differences

(23:47) Banking Fraud and Processes

(26:39) Gift Card Fraud

Episode Resources:

Security Lab LinkedIn Group

What is a Spear Phishing attack?

The Top 5 Spear Phishing Examples and Their Psychological Triggers

Hornetsecurity's Phishing Simulation, as part of its Security Awareness Service, is invaluable for organizations looking to protect themselves from the evolving spear phishing threats discussed in this episode. This solution provides realistic phishing simulations and comprehensive security awareness training, enabling employees to recognize and respond effectively to spear phishing attempts. By fostering a culture of security awareness, SAS is crucial for businesses aiming to strengthen their overall security posture and mitigate the risk of successful phishing attacks.

Lire plusRéduire

Data Broker Breaches - Insider Threats and More

Épisode 62

jeudi 19 septembre 2024 • Durée 40:27

In this episode of the Security Swarm Podcast, host Andy Syrewicze and guest Eric Siron provide a comprehensive monthly threat review. They cover several major cybersecurity incidents and trends from the past month, including:

The massive data breach at data broker National Public Data exposed over 2.9 billion personal information records. They discuss the risks of this breach, such as increased targeted phishing and social engineering attacks.

A joint government agency warning about the Ransom Hub ransomware has impacted over 200 victims since February 2022, including critical infrastructure and high-profile organizations.

A case study of an IT administrator who held his employer's systems for ransom by deploying logic bombs, highlighting the risks of insider threats even within trusted IT teams.

They also touch on the topics of vendor risk management and the history of election tampering and provide recommendations for organizations to mitigate these threats. In conclusion, EP62 provides valuable insights into the ever-changing cybersecurity landscape and offers practical advice for security professionals.

Do you want to join the conversation? Join us in our Security Lab LinkedIn Group!

Key Takeaways:

The National Public Data breach exposed a vast amount of personal information, including names, email addresses, phone numbers, Social Security numbers, and more. This creates risks of more targeted phishing and social engineering attacks.

The continued use of easily abused identification methods like Social Security numbers underscores the urgent need to explore more secure alternatives, such as cryptographic key pairs. This is crucial in reducing the risks of identity theft.

Insider threats from trusted IT staff members can pose a significant risk, as evidenced by the case of an IT admin holding their employer's systems for ransom. Implementing practices like just-in-time administration and least-privilege access is crucial to mitigate these potentially devastating threats.

Microsoft’s Security Saga Continues: Insights from Whistleblower

Épisode 53

lundi 22 juillet 2024 • Durée 35:42

In this episode, Andy sits down once again with Paul to continue their conversation about Microsoft’s struggles with security. The episode focuses on a recent report from ProPublica about a Microsoft whistleblower named Andrew Harris. The report alleges that Microsoft was aware of a serious vulnerability in its on-premises Active Directory Federation Services (ADFS) software that could have enabled the SolarWinds supply chain attack, but chose not to fix it or disclose it to customers.

Andy and Paul discuss how Microsoft's focus on new features and cloud growth over security, as well as the desire to win lucrative government contracts, may have contributed to this decision. They also touch on the challenges faced by Microsoft's security response team and the broader issue of security being seen as a cost center rather than a profit driver.

Key Takeaways:

Microsoft ignored a serious ADFS vulnerability that could have enabled widespread attacks.
Security is often viewed as a cost center at Microsoft, rather than a profit driver. This mindset led to the ADFS vulnerability being ignored, as fixing it was not seen as a priority compared to delivering new features and products.
Microsoft was criticized for not being transparent about the ADFS vulnerability and not giving customers the option to implement mitigations, even if it meant sacrificing some functionality.
The ADFS incident is symptomatic of broader security culture problems at Microsoft, where security is not always prioritized, and technical debt or legacy systems are not adequately addressed.

Timestamps:

(02:22) - Explaining the Whistleblower's Allegations and the SolarWinds Attack

(07:32) - Vulnerability in ADFS and Microsoft's "Security Boundaries" Argument

(13:06) - Why Was the Issue Swept Under the Rug?

(19:16) - The Challenges Faced by the Microsoft Security Response Center (MSRC)

(26:24) - Satya Nadella's Comments on Prioritizing Security over New Features

Summer Olympics 2024: How and Why Threat Actors Target the Games

Épisode 52

vendredi 12 juillet 2024 • Durée 30:00

In this episode of the Security Swarm podcast, host Andy is joined by Romain Basset from Hornetsecurity to discuss the cybersecurity implications of the upcoming 2024 Olympic Games in Paris, France. The conversation explores how the geopolitical landscape, with ongoing global tensions and conflicts, creates a high-profile stage that threat actors may target for hacktivism, financial gain, or destabilization.

Throughout the episode, they highlight the increased risks leading up to the 2024 Games, noting that French infrastructure has already been targeted by various threat actor groups, including DDoS attacks. They discuss the blurring lines between cybercrime and geopolitical threats, with many threat actors now engaging in both financially and politically motivated attacks.

Key takeaways:

The Olympics are a prime target for cyber-attacks due to the global attention and geopolitical tensions surrounding the event.
Past Olympic games have seen a variety of cyber-attacks, including distributed denial-of-service (DDoS) attacks, malware, and false flag operations to mislead attribution.
Cyber-attacks targeting the Olympics can have far-reaching consequences, including international chaos, disinformation campaigns, and real-world impacts on businesses and infrastructure.
While the threat landscape is complex, the best defense is to focus on cybersecurity basics like user training, multi-factor authentication, and regular backups - rather than getting distracted by the latest "shiny object" threat.

Timestamps:

(01:15) - Why Cybersecurity is Important for the Olympics

(02:25) - Geopolitical Tensions and Threat Actors

(04:31) - Potential Cyber Attacks - Scams, Extortion, Disinformation

(06:50) - The 2018 Pyeongchang Olympics Cyber Attack

(12:48) - False Flags and Attribution Challenges

(16:05) - Overlap Between Cybercrime and Geopolitical Destabilization

Celebrating 50 Episodes: A Review of our Top Security Discussions (PT2)

Épisode 51

mercredi 3 juillet 2024 • Durée 32:54

For our 50th episode of the Security Swarm Podcast, Andy and Eric Siron look back at the last 49 episodes of the show. They go through some core security topics and discuss whether they’re still relevant, how they’ve changed in comparison to the evolving threat landscape and provide updates on some of the major stories discussed.

This is part 2 of a 2-part episode.

Lire plusRéduire

Celebrating 50 Episodes: A Review of our Top Security Discussions (PT1)

Épisode 50

jeudi 27 juin 2024 • Durée 31:12

This is part 1 of a 2-part episode, with part 2 coming next week.

Key Takeaways:

AI-powered tools are a double-edged sword, capable of both beneficial and malicious applications.
Botnets and malware continue to be a persistent threat, as attackers adapt and find new ways to circumvent disruptions.
Email-based social engineering remains a significant vulnerability, as human nature makes it a difficult problem to solve.
Immutability and backups are critical for protecting against ransomware and data loss.
Securing cloud-based platforms like Microsoft 365 requires a nuanced approach, as the responsibility is shared between the provider and the customer.
Security awareness training can be challenging to implement effectively, requiring a balance between engagement and cost.
Navigating the relationship between IT administrators and CISOs is crucial for effective security management.

Timestamps:

(00:31) Using ChatGPT to create ransomware - still a relevant and evolving topic

(02:22) How tech pros should handle security news and zero-days

(09:09) The re-emergence of Emotet and the challenges of disrupting botnets

(12:04) The persistent problem of social engineering and email attacks

(13:25) The importance of immutability and backups against ransomware

(16:29) The security of Microsoft 365

(19:35) Deep dive on the QuickBot malware

(20:20) The necessity of advanced threat protection (ATP)

OSINT in The Hands of Hackers

Épisode 49

mercredi 19 juin 2024 • Durée 32:59

In this episode of the Security Swarm Podcast, host Andy is joined by Romain Basset, the Director of Technology Strategy at Hornetsecurity. They’re exploring the topic of Open-Source Intelligence (OSINT) - what it is, how threat actors use it to launch effective attacks, and the dangers it poses.

Throughout the episode, they discuss the ease with which OSINT can gather information using AI and other tools and provide examples of how it can be used in phishing, business email compromise, and even deep fake attacks. The conversation also touches on the importance of privacy awareness and security awareness training to mitigate these threats.

Key Takeaways:

OSINT refers to publicly available information that threat actors can easily gather to launch targeted attacks. This includes social media profiles, online forums, data breach databases, and more.
Threat actors are using OSINT to not only target individuals, but also find vulnerabilities in organizations' web-facing software and infrastructure.
Combating OSINT-powered attacks requires a multi-pronged approach of improving privacy awareness and implementing robust security awareness training programs.

Timestamps:

(02:24) - Definition of OSINT

(07:17) - How AI makes OSINT-powered attacks easier

(15:22) - Using OSINT to target organizations

(25:35) - Mitigating OSINT-powered attacks

Episode Resources:

Train your users with a personalised Security Awareness Service

Business Email Compromise: The $43 Billion Scam

The Security Implications of Migrating from VMware

Épisode 48

vendredi 14 juin 2024 • Durée 46:59

In this episode of the Security Swarm Podcast, host Andy and recurring guest, Paul, talk about the challenges and opportunities organizations face amidst the Broadcom acquisition of VMware. They discuss the steep price hikes for VMware licenses and the security vulnerabilities recently discovered in VMware products.

This acquisition has prompted many businesses to consider alternative solutions, and the episode provides a comprehensive overview of the available options within the Microsoft ecosystem. They cover a range of migration strategies, including moving to the Microsoft ecosystem through Azure, Azure Stack HCI, and on-premises Hyper-V solutions. Andy and Paul offer valuable insights into ensuring a secure and seamless transition away from VMware, making this episode essential listening for IT professionals navigating these significant changes.

Key takeaways:

Broadcom's Acquisition of VMware is Causing Major Disruption due to massive license cost increases of 300-500% for many organizations.
Microsoft Hyper-V is a Viable Alternative to VMware. It offers a mature, enterprise-ready hypervisor that can be a cost-effective replacement for VMware.
Azure Stack HCI Provides an On-Premises VMware Alternative. It provides a hyperconverged infrastructure solution with Hyper-V at the core, along with integration to Azure services for management and modernization.
Security pitfalls can arise when organizations rush to migrate away from VMware due to the Broadcom situation. Proper planning, understanding the security posture of the new platform, and ensuring critical configurations like backup are in place are essential to mitigate risks.

Timestamps:

(02:51) - Vulnerabilities in VMware

(07:30) - Migrating to the Microsoft Ecosystem

(13:38) - On-Premises Microsoft Options

(38:45) - Security Considerations for Migrations

(44:52) - Pragmatic Approach to Platform Selection

New Threat Campaign Distributing DarkGate Malware & The Massive 911 S5 Botnet Takedown

Épisode 47

lundi 10 juin 2024 • Durée 38:40

In this episode of the Security Swarm Podcast, host Andy and recurring guest Eric Siron discuss the Monthly Threat Review for June 2024. They explore a new threat campaign distributing the Darkgate Malware using a technique called pastejacking. Additionally, they touch upon the 911 S5 Proxy Botnet takedown and how threat actors are exploiting Stack Overflow to distribute malware.

Key takeaways:

Awareness of common tactics like pacejacking can help prevent falling victim to malware campaigns.
Read the details of the Darkgate attack methods we show in the report and adjust your security posture as needed. If you’re in need of powerful, next-gen email security software, we’ve got you covered.
If your organization is leveraging software from any online, public repository, take the time to review that repository and do a risk assessment. Threat-actors are increasingly using public software repos for malicious purposes.

Timestamps:

(03:15) - Insights into Email Threat Trends and Industry Targeting in Cybersecurity Landscape

(13:15) - Unveiling New Cybersecurity Threat Campaign using Pastejacking

(23:31) - Massive Botnet Take Down and Arrest of Operator: A Victory Against Cybercrime

(29:29) - Beware of Malicious Packages: A Cautionary Case Study from Stack Overflow

Episode Resources:

Full Monthly Threat Report

Enhance Security Awareness by Training Employees

Windows Server 2025: New Security Features Revealed

Épisode 46

vendredi 31 mai 2024 • Durée 46:14

In this podcast episode, Andy and Paul discuss the upcoming release of Windows Server 2025 and the myriad security enhancements it will bring. They delve into various topics such as improvements to Active Directory, delegated managed service accounts, Kerberos protocol enhancements, SMB enhancements, hot patching, REFS file system for confidential computing, and extended security updates.

Key takeaways:

Windows Server 2025 brings a host of security enhancements.
The release date of Windows Server 2025 is speculated to be in September 2024, coinciding with the release of System Center 2025.

Timestamps:

(07:05) - Enhancements in Active Directory Security and Numa Support: A Deep Dive

(13:19) - Revolutionizing Service Accounts: Delegated Managed Service Accounts Explained

(20:28) - Revamping Windows Server Security: Say Goodbye to NTLM and Hello to Kerberos

(28:15) - Revolutionizing SMB with Quick Protocol and Hot Patching in Windows Server 2025

(32:34) - Revolutionizing Patching with Hot Patching in Windows Server and Azure

(36:02) - Revolutionizing Data Protection with Resilient File System and Confidential Computing

(39:34) - Exploring Confidential Compute, Server Upgrades, and Extended Security Updates in Windows Server Environment

(42:37) - Windows Server 2025 Release Date Speculations and Future Episode Teasers

Episode Resources:

What’s new in Windows Server 2025 from MS Learn

Podcasts Similaires Basées sur le Contenu

Découvrez des podcasts liées à The Security Swarm Podcast. Explorez des podcasts avec des thèmes, sujets, et formats similaires. Ces similarités sont calculées grâce à des données tangibles, pas d'extrapolations !