Patch smarter, not harder.
Lieuwe Jan Koning and ON2IT Field CTO Rob Maas break down why “patch everything now” isn’t a strategy, but a risk multiplier. In this session, they teach a practical patching strategy: know your assets, patch edge first, stage updates, and use Zero Trust segmentation to choke off exposure so you only patch what truly matters: fast, safely, and without outages.

• (00:00) - 01:11 - Intro
• (01:11) - - 02:28 - Reality check #1: Not everything can be patched
• (02:28) - - 05:02 - Reality check #2: Patches are scary
• (05:02) - - 08:45 - The solution: Patch in phases
• (08:45) - - 10:36 - How Zero Trust enables patch management
• (10:36) - - 11:23 - Prioritization matters
• (11:23) - - 14:50 - Patching tips and tricks
• (14:50) - - 16:21 - Guidelines for patching triage
• (16:21) - - 17:37 - Practical advice
• (17:37) - - END - Outro

Key Topics Covered

·       Why “patch everything immediately” fails; availability vs. security

·       Staged deployments and rollback safety for crown-jewel services

·       Zero Trust segmentation to reduce urgency and shrink attack surface

·       Priority signals that matter: asset criticality, exposure, KEV, CVSS

Related ON2IT content & explicitly referenced resources
ON2IT Zero Trust: https://on2it.net/zero-trust/
Threat Talks (site): https://threat-talks.com/
CVSS (FIRST): https://www.first.org/cvss/
CISA guidance – Citrix/NetScaler (Citrix Bleed example): https://www.cisa.gov/guidance-addressing-citrix-netscaler-adc-and-gateway-vulnerability-cve-2023-4966-citrix-bleed
Crowdstrike episode: https://youtu.be/IRvWVg1lSuo?si=f8Sj6WYG0KNxlkJD 

Click here to view the episode transcript.

How solid is your digital trust—or are you just hoping your PKI is secure?
Let’s be honest: too many companies run on borrowed trust and forgotten certificates. In this episode of Threat Talks, ON2IT’s Lieuwe Jan Koning and Rob Maas pull back the curtain on what really holds your digital world together—and what can tear it down overnight.
They break down PKI in plain language: the root of trust that must stay locked away, the intermediates that keep your systems running, and the automation that stops your team from clicking “ignore” on yet another warning.
You’ll see why rolling your own keys beats trusting anyone else, how to keep your devices speaking the same language of trust, and why short-lived certificates might just save you from the next big breach.
This isn’t theory—it’s how Zero Trust really starts: by proving that your organization can trust itself.

Additional Resources
• Threat Talks Episode on SSL Decryption – https://youtu.be/Xv_jVHVsD9w
• ON2IT Zero Trust: https://on2it.net/zero-trust/
• ACME protocol (RFC 8555): https://datatracker.ietf.org/doc/rfc8555/
• Let’s Encrypt / ACME protocol – https://letsencrypt.org
• DigiNotar case study background – https://en.wikipedia.org/wiki/DigiNotar
• Mozilla CA Program (trusted root store): https://wiki.mozilla.org/CA
• infographic about encryption  https://on2it.s3.us-east-1.amazonaws.com/20250304_Infographic_Encryption.pdf

Guest & Host Links:
Rob Maas (Field CTO, ON2IT): https://www.linkedin.com/in/robmaas83/ 
Lieuwe Jan Koning (Founding Partner, ON2IT): https://www.linkedin.com/in/lieuwejan/

Key Topics Covered
•  Why root certificates must never be online—and how intermediates provide a safe fallback.
•  Real-world PKI failure: DigiNotar compromise and lessons for CISOs.
•  How ON2IT built a secure, low-cost PKI with offline key bearers and ACME automation.
•  The hidden risks of training employees to ignore certificate warnings—and how Zero Trust demands the opposite.

🔔 Follow and Support our channel! 🔔
=== 
► YOUTUBE: https://youtube.com/@ThreatTalks
► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E
► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520

👕 Receive your Threat Talks T-shirt
https://threat-talks.com/

🗺️ Explore the Hack's Route in Detail 🗺️
https://threat-talks.com

🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Russia’s most notorious cyber unit—Seashell Blizzard (also known as Sandworm, APT 44 and Iron Viking)—has taken down shipping giants, Olympic systems, and Ukraine’s power grid.

In this Threat Talks deep dive, Lieuwe Jan Koning, Yuri Wit (Red Team), and Rob Maas (Blue Team) reveal exactly how these attacks unfold, why they’re so hard to stop, and how Zero Trust can tip the balance back to defenders.

• (00:00) - – Cyber warfare in the Ukraine conflict: setting the stage
• (01:10) - – Who is Seashell Blizzard? Names, aliases, and Russian GRU ties
• (04:00) - – NotPetya, Olympic Games, and high-profile disruption campaigns
• (07:31) - – Initial access: stealth exploits on edge devices
• (11:40) - – Privilege escalation via Living-off-the-Land (LOLBin) tactics
• (15:23) - – Weaponizing Group Policy Objects with “Tank Trap” for mass wipers
• (19:13) - – Objectives: disruption, damage, and public bragging rights
• (23:40) - – Zero Trust defenses, segmentation, and last-resort recovery

Key Topics Covered
• Seashell Blizzard’s attack chain: from stealth reconnaissance to mass destruction.
• NotPetya & global fallout: when a Ukraine-targeted attack crippled global shipping.
• Defense strategies: hardening edge devices, segmentation, and EDR behavior detection.
• Zero Trust in action: protecting critical assets before the breach happens.

Related ON2IT Content & Referenced Resources
• ON2IT Threat Talks Playlist: https://www.youtube.com/@ThreatTalks/playlists ON2IT Zero Trust Resources: https://on2it.net/zero-trust
• MITRE ATT&CK – Sandworm Team (APT 44): https://attack.mitre.org/groups/G0034/

Click here to view the episode transcript.

🔔 Follow and Support our channel! 🔔
=== 
► YOUTUBE: https://youtube.com/@ThreatTalks
► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E
► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520

👕 Receive your Threat Talks T-shirt
https://threat-talks.com/

🗺️ Explore the Hack's Route in Detail 🗺️
https://threat-talks.com

🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

One mis-typed contact detonates Signal Gate, turning “secure” messaging into a classified-data leak.Host Lieuwe Jan Koning (Co-founder, ON2IT) and Thomas Manolis (Security Officer, AMS-IX) lay out the breach blow-by-blow—then drop the Zero Trust, Shadow IT and information-governance tactics every CISO needs before the next incident hits.High stakes, hard lessons—compressed into actionable steps you can brief to the board.Timestamps00:00 Cold-open: “wrong recipients” analogy00:37 What really happened in Signal Gate01:38 Mistake #1 – Choosing a consumer app over classified03:34 Mistake #2 – Human error: the mis-added journalist07:55 Shadow IT, usability & Secure Messaging Apps 09:10 Information Governance, audits and technical controls12:02 Zero Trust takeaways & action planKey Topics Covered• Anatomy of the Signal Gate breach & timeline• Why Shadow IT sabotages secure operations• Building airtight Information Governance for secure messaging apps• Operationalizing Zero Trust: least privilege, continuous verification, human-centric trainingRelated ON2IT Content & Referenced Resources• “Understanding Zero Trust – Lessons from Experts” whitepaper: https://on2it.net/resources/?• Zero Trust Readiness Assessment (PDF): https://on2it.net/wp-content/uploads/2022/05/Zero-Trust-Readiness-Assessment-EN-US.pdf• Threat Talks podcast hub: https://threat-talks.com/🔔 Follow and Support our channel! 🔔=== ► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520👕 Receive your Threat Talks T-shirthttps://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

ON2IT’s Lieuwe Jan Koning goes one-on-one with AMS-IX CEO Peter van Burgel to expose why the once-open internet is splintering into rival, firewalled regions. Discover the geopolitical forces fueling this cybersecurity trend. Learn the Zero Trust resilience moves CISOs must deploy to stay sovereign in the future of the internet.Key Topics Covered• Drivers behind the Splinternet & what they mean for CISOs• Scenario-planning methodology for threat forecasting• Aligning Zero Trust with data-localization mandates• Resilience vs. redundancy: how to build real business continuity• Earth-IX concept: keeping critical flows alive amid fragmentationRelated Content & Resources• ON2IT Zero Trust Framework → https://on2it.net/zero-trust/• AMS-IX MORE-IP Conference insights → https://www.ams-ix.net/ams• EU Digital Services Act overview → https://digital-strategy.ec.europa.eu/en🔔 Follow and Support our channel! 🔔► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520👕 Receive your Threat Talks T-shirthttps://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Administrative accounts come with serious power – and serious power, comes with serious risk.
In part B of our deep dive into step four of Zero Trust (create Zero Trust policy), host Lieuwe Jan Koning and ON2IT Field CTO Rob Maas unpack how to build Zero Trust policies specifically for administrative access.
 They explore:
1) Why admins are a high-value target – and what that means for policy
2) How to build secure jump hosts and enforce strict access controls
3) What ‘separation of identity’ really looks like in practice
 
🎧 Part B builds on the policy work discussed in part A. Worth a listen if you deal with access management or design policy.
Shownotes
⁃       Zero Trust Step 1 episode: https://youtu.be/mC66i-tEEFs
⁃       Zero Trust Step 2 episode: https://youtu.be/wp0q9aZHuXc
⁃       Zero Trust Step 3 episode: https://youtu.be/eGsw2JCnrac
⁃       Zero Trust Step 4a episode: https://youtu.be/qT_nqbBEkVw

Now that you’ve defined your protect surfaces, mapped your transaction flows and built your Zero Trust architecture, it’s time for step four of Zero Trust: creating policy. In other words, it’s time to turn strategy into actual rules.
In this episode of Threat Talks, host Lieuwe Jan and Koning and Field CTO of ON2IT Rob Maas talk through how to create and validate Zero Trust policies.
They explore:
·      What makes a ‘good’ policy (and why broad strokes won’t cut it)
·      How to apply the Kipling method to policy creation
·      Why policies need ongoing validation to stay effective
 
Make sure to stay tuned for the second part of this episode as well, where Lieuwe Jan and Rob dive into the specifics of policy for administrative access.
Shownotes
⁃       Zero Trust Step 1 episode: https://youtu.be/mC66i-tEEFs
⁃       Zero Trust Step 2 episode: https://youtu.be/wp0q9aZHuXc
⁃       Zero Trust Step 3 episode: https://youtu.be/eGsw2JCnrac

What does quantum computing mean for blockchain? And how should platforms respond before Q-day becomes reality? In this episode of Threat Talks, ON2IT Field CTO Rob Maas is joined by Jeroen Scheerder, who leads ON2IT's post-quantum cryptography research group. They explore how quantum algorithms interact with current blockchain designs, what makes certain cryptocurrencies more flexible than others, and where we're already seeing movement toward future-ready solutions. ⛓ How does blockchain actually work again? 🔓 What makes classical encryption vulnerable to quantum algorithms? 🧠 Why can't you just “update” Bitcoin? From cryptographic design to real-world limitations, this episode is all about understanding the risks and opportunities in a post-quantum future. Shownotes Post-Quantum Threat to Encryption episode : https://youtu.be/rimW1XJNNLo

Windows Recall is a new feature in Windows 11 that captures screenshots every few seconds and stores them in a local database. It’s designed to help users find what they’ve seen or done: but that convenience may come at a high cost.

In this episode of Threat Talks, ON2IT Field CTO Rob Maas speaks with security expert Jeroen Scheerder about the real risks of Recall. They break down how the tool works, what data it captures, and why the built-in protections may not be enough.

In this episode of Threat Talks:

🧠 How Recall works and what makes it so controversial

🔍 Why bolted-on security measures leave gaps

🎯 Which users and organizations are most exposed

Tune in to hear why Windows Recall is raising red flags and what you need to know to protect your organization.

Andy Grotto (founder and director of the Program on Geopolitics, Technology and Governance at Stanford University) puts it plainly: there's a 5% chance that within the next 10 years, AI could rule over humans. That number might sound small, but it's enough to take seriously.

He joins host Lieuwe Jan Koning and guest Davis Hake (Senior Director for Cybersecurity at Venable) as they dive into the technology, governance, and risks behind autonomous AI. From system trustworthiness to liability, and market incentives to regulation, they break down what’s already happening and what needs to happen next.
They also discuss how humans will struggle to validate AI outcomes in areas where AI excels, why thoughtful deployment is key, and what it means to be “quick, but not in a hurry.” 

Key topics:
✅ How to adopt your security and governance to the use of AI
🧠 Why applying existing IT risk frameworks is a smart starting point
⚖️ How to balance regulation, trust, and innovation
Can your organization keep up with AI that moves faster than human oversight?

It’s time to get practical. After identifying protect surfaces and mapping flows, the third step in Zero Trust is about designing the actual architecture.In this episode of Threat Talks, Lieuwe Jan and Rob Maas talk about segmentation, control selection, and why this is the most operational step in your Zero Trust journey.They cover:✅ Why segmentation is one of the most important Zero Trust measures🔒 How to choose and assign technical controls (and what matters most)📄 How frameworks like MITRE ATT&CK, ISO 27001, and the Cyber Kill Chain help map risks to controlsFrom translating compliance requirements into actionable controls to whiteboarding micro-perimeters and network segments, this is where the vision meets the real world.Shownotes:⁃ Zero Trust Step 1 episode: https://youtu.be/mC66i-tEEFs ⁃ Zero Trust Step 2 episode: https://youtu.be/wp0q9aZHuXc ⁃ Rick Howard episode on the Kill Chain https://www.youtube.com/watch: v=GC8z3W2OSwQ&t=1s ⁃ Outlook Web Access Deep Dive episode: https://www.youtube.com/watch?v=Bd5mhPiqT5Q 🔔 Follow and Support our channel! 🔔=== ► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520👕 Receive your Threat Talks T-shirthttps://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

From sovereign clouds to Zero Trust, and from cross-border investments to threat intelligence sharing, cooperation between the US and Europe is crucial, but still complex. With differing policies, fragmented markets, and varying strategies, the cyber world remains anything but unified.In this special episode of Threat Talks, Davis Hake (Senior Director for Cybersecurity at Venable) leads a discussion with Lisa Hill (Director of Investor Relations at Shield Capital), Chris Painter (the US’s first cyber ambassador and founder partner of the Cyber Policy Group), Lieuwe Jan Koning (CTO and co-founder of ON2IT cybersecurity) and Peter Brown (former EU official and diplomat). Together, they explore where collaboration is gaining ground and where major obstacles still stand. 🌐 How do the US and EU differ in their approach to Zero Trust and prevention?📊 What role does private sector investment play in advancing national security?🔁 Why is threat intelligence still so difficult to share effectively across borders?Tune in for a grounded conversation that connects regulation, strategy, and industry, and shows how both sides of the Atlantic are navigating today’s cyber challenges.🔔 Follow and Support our channel! 🔔=== ► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520👕 Receive your Threat Talks T-shirthttps://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

One unlocked phone can unravel the defenses of a billion-dollar enterprise—because in cybersecurity, small mistakes don’t stay small for long. Attackers can read notes, steal IDs, or impersonate you on WhatsApp. A reused password can launch a remote tool that looks completely legitimate.

Rob Maas (Field CTO, ON2IT) and Luca Cipriano (Cyber Threat Intelligence Program Lead, ON2IT) reveal how poor cyber hygiene erodes trust, endangers partners, and weakens enterprise defenses.
CISOs, CIO and IT managers remember: in a Zero Trust world, your weakest link might not even be inside your organization.

• (00:00) - Why your cyber hygiene affects others
• (00:28) - Meet the speakers (Rob Maas, Luca Cipriano)
• (00:47) - Cyber hygiene defined for CISOs
• (03:00) - Unlocked phone → passwords in notes, WhatsApp fraud, ID photos
• (05:53) - SOC case: contractor email compromise → remote tool drop (ConnectWise)
• (09:40) - OSINT: 19 breaches + iterative password reuse
• (17:01) - What to fix now: MFA, vaults, device lock, breach monitoring
• (20:24) - Final takeaways & resources

What You’ll Learn (From Real-Life Example Discussions)
• How a stolen phone quickly turns into identity theft, impersonation, and scams targeting your contacts.
• A real SOC case: a contractor’s reused password allowed attackers to hide a remote access tool inside normal IT activity.
• How OSINT and dark web data reveal how password reuse spreads risk across accounts.
• Why shared tools like Google Docs can quietly multiply breaches when one user slips up.
• Simple upgrades—MFA, password vaults, breach alerts, and secure devices—that cut your organization’s exposure fast.

Click here to view the episode transcript.

Related ON2IT Content & Referenced Resources
• ON2IT: https://on2it.net/
• Threat Talks: https://threat-talks.com/
• AMS-IX: https://www.ams-ix.net/ams
• WatchYourHack: https://watchyourhack.com
• Have I Been Pwned: https://haveibeenpwned.com

Guest and Host Links: 
Rob Maas, Field CTO, ON2IT: https://www.linkedin.com/in/robmaas83/ 
Luca Cipriano, Cyber Threat Intelligence Program Lead, ON2IT: https://www.linkedin.com/in/luca-c-914973124/

If this helped, subscribe to Threat Talks. Share this episode with your partners and contractors—stronger cyber hygiene across your ecosystem protects everyone. 

🔔 Follow and Support our channel! 🔔
=== 
► YOUTUBE: https://youtube.com/@ThreatTalks
► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E
► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520

👕 Receive your Threat Talks T-shirt
https://threat-talks.com/

🗺️ Explore the Hack's Route in Detail 🗺️
https://threat-talks.com

🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

AI vs. Human Pentesting: Who Wins?What happens when you try to automate something that’s part science, part art? In an industry rushing to adopt AI for everything from detection to response, the real question is: can a machine truly replace the craft of a human pentester?In this episode of Threat Talks, host Lieuwe Jan Koning is joined by Melanie Rieback, co-founder and CEO of Radically Open Security, and Luca Cipriano, a red teamer and threat intel specialist. Together, they dig into what makes great pentesting work.Melanie explains why her company donates 90% of profits to open source and operates with a not-for-profit model, and how that connects with their mission to support NGOs and civil society groups. Together, she and Luca share their hands-on experience with pentesting and why creativity, gut instinct, and lateral thinking are still crucial in ethical hacking.They discuss:🤖 Can AI outsmart human red teamers?🧠 What makes great hacking truly human?🔍 What’s still too complex for automation?From tool-assisted testing to old-school intuition, this conversation offers a grounded take on the reality of modern pentesting and what AI can’t do (yet).🔔 Follow and Support our channel! 🔔=== ► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520👕 Receive your Threat Talks T-shirthttps://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

PLCs with default passwords. Devices searchable online. Siloed asset inventories. These OT challenges are common, but they’re also fixable. In this episode of Threat Talks, host Lieuwe Jan Koning sits down with Venable’s Caitlin Clarke and Schneider Electric’s Patrick Ford to discuss why the OT side of your business deserves the same focus and attention as IT. From default passwords to exposed PLCs, they show how these ‘tech risks’ span beyond just OT and IT. They discuss:✅ How to replace "default" thinking on OT security🌐 Spotting internet-facing assets before attackers do🔍 Using CISA’s Installed Base Initiative to locate orphaned tech🤝 Building joint response plans across IT, OT, and governmentOrganizations are getting ahead of risk by building live OT inventories, applying smart controls, and partnering with federal teams to strengthen critical infrastructure. Are you ready to join them?Additional Resources:► Securing critical infrastructure: https://www.se.com/ww/en/download/doc...🔔 Follow and Support our channel! 🔔=== ► YOUTUBE:    / @threattalks  ► SPOTIFY: https://open.spotify.com/show/1SXUyUE...► APPLE: https://podcasts.apple.com/us/podcast...👕 Receive your Threat Talks T-shirthttps://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Once you have defined a few protect surfaces (see: ⁠Step 1 of Zero Trust-video link below⁠), the next step is to start mapping the transaction flows: how these protect surfaces communicate with one another.

 

Understanding how data travels to, from and around protect surfaces is your next logical movie. Why? Because if you don’t know how your systems talk to each other, you can’t secure them.

 

In this episode of Threat Talks, host Lieuwe Jan Koning and Field CTO Rob Maas discuss how to identify communication paths between protect surfaces and why this visibility is critical for both risk containment and policy validation.

They explore:

✅ How to identify communication paths

⛕The difference between inbound and outbound traffic (and why this matters)

🙋🏼‍♂️Why business owners and business context are essential

Get all the details and

insights on this second step of Zero Trust: mapping the transaction flows.

Additional Resources:

► Zero Trust Step One: https://youtu.be/mC66i-tEEFs

Now that we know what a PLC, HMI and SCADA are (check out last week’s episode for a refresher if you need one!), we’re ready for part two of our OT deep dive: how does an OT attack work? In this Deep Dive, Rob Maas and Luca Cipriano break down just how complex an OT attack really is. From needing to stay hidden, to requiring access to very specific system settings and blueprints; setting up a successful OT attack (thankfully) is no easy task. But does that mean it’s easier to defend against them?Key topics:⚙️ How IT and OT attacks differ☠️ What the ICS cyber kill chain is🌎 How OT attacks can impact whole nationsJoin Rob and Luca for a discussion on the motivations behind OT attacks, how to bridge the gap between cybersecurity and engineering, and what we can do to prevent these high impact OT attacks.

Additional Resources:

► Operational Technology for Dummies (Previous Episode): https://youtu.be/Pdp_OCf6npQ

► Inside Volt Typhoon: China’s Silent Cyber Threat: https://youtu.be/DSalzpj59RI

► Hack the Boat - cybersecurity on the high seas 🌊 - Threat Talks Cybersecurity Podcast: https://youtu.be/Xa0TJ3eRTCw

From heating systems in Ukraine to petrochemical plant safety controls, Operational Technology (OT) systems are the hidden workhorses behind critical infrastructure: and they're wide open to cyber threats.

 

In this Deep Dive, Rob Maas sits down with Luca Cipriano to break down what OT is, why it’s different from IT, where the two overlap and how we can start securing both before it’s too late.

 

Key topics:

⚙️ What OT is (and isn’t)

📉 Why IT and OT often don’t speak the same language

🛠️ Real-life OT cyberattacks (hello, FrostyGoop and TRITON)

Welcome to OT 101: explained in plain language, with a healthy dose of practicality.

From ships and cities to hospitals and airports, Operational Technology (OT) keeps the world running. The problem? It was never designed with cybersecurity in mind.

 

In this episode of Threat Talks, host Karin Muller is joined by TC Hoot (VP of Contracts at TAC) and Luca Cipriano (Threat Intel Specialist at ON2IT) to explore how airports, hospitals, ports, and even water systems can be compromised.

 

Key topics they tackle:

🛳️ Why are modern ships, airports, hospitals and even cities targeted?

🛡️ What makes OT so hard to secure compared to IT?

✈ What do real-world OT threats look like and how can we defend against them?

 

If you’ve ever asked “how could a fish tank lead to a casino breach?” or “can someone actually hack an airport’s baggage system?” this one’s for you.

Zero Trust is about more than just IP addresses and firewalls: it’s about understanding what truly matters to your business.

In step one of Zero Trust: define your protect surface, we focus on how to prioritize what you want to protect, how to avoid common pitfalls, and how to kick off your Zero Trust journey from a solid, business-aligned foundation.

In this episode of Threat Talks, host Lieuwe Jan Koning and Field CTO Rob Maas get down to the basics of step one of Zero Trust: defining the protect surface.

They explore:

✅ Methods for defining protect surfaces

⛨ Establishing the relevance of each protect surface

📈 How to align your cybersecurity with business needs and goals

In this second episode of a multi-part deep dive on Zero Trust, Lieuwe Jan and Rob clarify where to start with Zero Trust implementation, discuss the importance of business and board involvement and explain why starting small is key.

Zero Trust is everywhere – but what does this actually mean? Is it a cybersecurity strategy, a set of tactics, a product you can buy, or just clever marketing?

In this kickoff episode of this Zero Trust series, Lieuwe Jan Koning and Rob Maas explore what Zero Trust actually is, how to think about it strategically, and why it’s not just about identity or buying new tools.

They discuss:

✅ Why Zero Trust isn’t a product, and what it actually is

🗺️ The five steps and four core principles of Zero Trust

🚧 Why business alignment – and not anything technical – is the hardest part of Zero Trust implementation

They debunk the most common myths, from “Zero Trust is identity” to “just buy a firewall,” and explain what it takes to embed Zero Trust into business operations. A must-watch, whether you’re just curious, are just starting your Zero Trust journey or are already well underway.

What happens when a cyber threat actor doesn’t want to make headlines? Volt Typhoon, a state-sponsored group tied to the People’s Republic of China, has been quietly infiltrating Western critical infrastructure, staying under the radar by avoiding malware, using native tools, and taking things slow.

 

In this episode of Threat Talks, Lieuwe Jan Koning is joined by Rob Maas and Luca Cipriano to break down how these attackers operate and what their endgame might be.

 

💨 What makes “low and slow” attacks so hard to detect?

🔧 How do living-off-the-land tactics help attackers blend in?

📉 What motivations do threat actors like Volt Typhoon have?

 

Volt Typhoon isn’t just another cyber threat: it’s a sign that the game has changed. If you’re focused on national security, infrastructure, or advanced threat defense, you won’t want to miss this episode.

Dark Markets are making cybercrime more accessible than ever. Malware, remote access tools, phishing kits, credit cards information: all of it is readily available, and oftentimes available as a service, if you just know where to look. Subscribing to these illicit services is now as easy as signing up for Disney+.

 

In this Deep Dive, host Rob Maas and special guest, cybersecurity researcher Michele Campobasso, discuss dark markets, and the rise of cybercrime-as-a-service.

 

Key questions answered in this Deep Dive:

🕶️ What are dark markets, and how do they work?

🔑        How do cybercriminals (or intrepid researchers) access these dark markets?

🎬        How is cybercrime becoming as accessible as a streaming service?

⚠️  What risks do businesses face from dark markets?

🔎        What role does threat intelligence plays in monitoring these markets?

 

With cybercrime as easy to access as a Netflix subscription, Rob and Michele explore how these underground marketplaces operate, how they’re changing the threat landscape, and what organizations can do to protect themselves.

The internet promised freedom. Now it monetizes you. The trade-off? Convenience for control.
In this episode, Lieuwe Jan Koning and Prof. Jacobs reveal how scattered tools like meta and X create security gaps—and how one policy, fewer interfaces, and less data shared cut exposure and keep operations running.

Real examples you’ll hear:
• The neighborhood chat stuck on WhatsApp—and how switching to Signal breaks dependency.
• How your address book upload leaks other people’s data to platforms.
• Why secure doesn’t mean private on platforms that profit from your data.
• Age checks done right: passport chip + selective disclosure instead of oversharing.
• Patient groups and municipalities using PubHubs for private, verified rooms (no ads).
• Continuity risk in the real world: federated login outages, US-dependent authenticators, transatlantic cable cuts, and a court moving email to ProtonMail to stay operational.

• (00:00) - – Free vs. monetized internet
• (02:22) - – Facebook: secure ≠ private
• (05:31) - – WhatsApp vs. Signal trade-offs
• (07:05) - – Metadata & social graph risk
• (11:58) - – Attribute-based auth (Yi)
• (19:55) - – Decentralized login; split keys
• (28:11) - – PubHubs: private, verified rooms
• (49:54) - – Continuity: vendor/cable risk
• (56:01) - – Close & takeaways

Related ON2IT Content & Referenced Resources
• ON2IT: https://on2it.net/
• Threat Talks: https://threat-talks.com/
• AMS-IX: https://www.ams-ix.net/ams
• Yivi (privacy-preserving authentication): https://yivi.app/
• PubHubs (privacy-first social platform): https://pubhubs.net/
• European alternatives (mentioned): http://european-alternative.eu/
• Privacy tools (mentioned): https://privacytools.io/

Guest and Host Links: 
Lieuwe Jan Koning (ON2IT Co-Founder): https://www.linkedin.com/in/lieuwejan/ 
Bart Jacobs: http://www.cs.ru.nl/~bart/

If this helped you strengthen your Zero Trust policy, subscribe, like, and share. New episodes weekly. Follow Threat Talks on YouTube, Spotify, and Apple Podcasts.

Click here to view the episode transcript.

🔔 Follow and Support our channel! 🔔
=== 
► YOUTUBE: https://youtube.com/@ThreatTalks
► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E
► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520

👕 Receive your Threat Talks T-shirt
https://threat-talks.com/

🗺️ Explore the Hack's Route in Detail 🗺️
https://threat-talks.com

🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

The Dark Web Economy: Hacks for $10?

Would you pay $10 for access to a corporate system? Because someone on the dark web already has. In this episode of Threat Talks, host Lieuwe Jan Koning talks to cybersecurity researcher Michele Campobasso about the business of cybercrime. From ransomware services to stolen credentials, the dark web is thriving.

 

💰 How much is YOUR data worth on the dark web?
🚨What’s for sale—and who’s buying?
🛒 How is hacking becoming a subscription-based service?

 

Cybercriminals operate like well-run businesses, offering hacking tools, stolen credentials, and even customer support. But if cybercrime is getting more sophisticated, what can individuals and businesses do to fight back?

⏳ What happens when time goeswrong?

 

Time synchronizationis an overlooked but essential part of cybersecurity. A few microseconds ofdrift can lead to failed transactions, inaccurate forensic logs, or evensecurity breaches.

 

In this episode of ThreatTalks, host Rob Maas (Field CTO, ON2IT) and guest Jan van Boesschoten(Innovation Manager, AMS-IX) discuss:

 

·      How does time impact cybersecurity, and whathappens when it drifts?

·      Why is NTP no longer sufficient for high-speeddigital transactions?

·      How does Precision Time Protocol (PTP) providemicrosecond accuracy (and why does that matter)?

·      Could time manipulation be an attack vector,and how do organizations mitigate this risk?

 

From financialtransactions to forensic log analysis, knowing exactly when an eventoccurs can make or break an organization’s security posture.

Many organizations hesitate to implement SSL decryption due to concerns over complexity, privacy, and performance. However, the reality is that failing to decrypt means failing to see threats.In this Deep Dive, host Lieuwe Jan Koning and Rob Maas (Field CTO at ON2IT) explore why decrypting SSL traffic is critical for cybersecurity.

• Why is SSL decryption necessary, and what are the risks of ignoring encrypted traffic?
• How do modern malware and attacks leverage encryption to bypass traditional security measures?
• What are the top three things organizations must do to implement SSL decryption effectively?
• Why do only 3.5% of organizations have an active SSL decryption policy, and how can this change?

Rob Maas explains how decrypting SSL traffic allows security teams to detect and stop threats at an early stage, preventing malware downloads, phishing attempts, and web-based attacks before they reach endpoints.

Cybersecurity shouldn’t always be about playing defense – it can also be about disrupting attackers before they succeed. In this Deep Dive, host Lieuwe Jan Koning and cybersecurity expert Rick Howard break down the Intrusion Kill Chain and the strategic shift it introduced in the world of cybersecurity.

•  How does the Intrusion Kill Chain flip the script on cyberattacks?
• The 250 active adversary campaigns that security teams must track
• How MITRE ATT&CK and the Diamond Model strengthen modern defense strategies
• Why global governments and intelligence agencies aren’t doing more to share cyber threat intelligence

 

Despite decades of talk about intelligence sharing, most information is still exchanged manually, often via spreadsheets. As Howard points out, a true global threat-sharing framework could give defenders the upper hand.

Don’t miss this deep dive into adversary strategies and what they mean for the future of cybersecurity.

👕 Receive your Threat Talks T-shirt via https://threat-talks.com/

🗺️ Explore the Hack's Route in Detail 🗺️ via https://threat-talks.com

🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

I think, therefore I am, is René Descartes’first principle. But how does that relate to cybersecurity?

 

In this episode of Threat Talks, hostLieuwe Jan Koning is joined by Rick Howard – former Commander of the US Army’sComputer Emergency Response Team and former CSO of Palo Alto Networks – todiscuss the first principle of cybersecurity.

 

❓What’s the difference between cybersecurity strategy and tactics?

❓How come some random geezers are better at cybersecurity forecastingthan industry pros?

❓Is resilience the ultimate cybersecurity strategy?

❓Why does Rick Howard think Zero Trust is a passive strategy? 

 

And for the book lovers amongst us – over500 cybersecurity books are published each year. Wanna know which are worthyour time?

 

Rick Howard’s Cybersecurity Canon has gotyou covered: https://icdt.osu.edu/about-cybersecurity-canon

👕 Receive your Threat Talks T-shirthttps://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

🚨 Can you still trust what you see? 🚨

Deepfakes aren’t just for entertainment anymore: they’re now an increasingly powerful tool for cybercriminals. With AI advancing rapidly, attackers can clone voices, fake identities, and manipulate live video in real time.

In this episode of Threat Talks, we explore how deepfake scams have already cost companies millions.

From CEO voice fraud to bypassing identity checks, the risks are rising.

👥 How do deepfakes work?

👥 What makes them so dangerous?

👥 How can organizations protect themselves?

Join host Rob Maas and ON2IT SOC analyst Yuri Wit as they break down the latest deepfake threats and what you can do to stay ahead.

👕 Receive your Threat Talks T-shirt https://threat-talks.com/🗺️ Explore the Hack's Route in Detail

🗺️https://threat-talks.com

🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Quantum computing promises unprecedented computational power, but it also threatens the encryption standards we trust today.

In this episode of Threat Talks, Jeroen Scheerder from ON2IT delves into post-quantum cryptography and answers key questions:

• What is Quantum Computing?
• Why does it challenge RSA and other encryption standards?
• What is Q-Day, and when will it happen?
• How can companies prepare for the post-quantum era?

🎯 Key Takeaways

🛡 Data minimization and post-quantum cryptographic algorithms are essential.

📈 Start planning your migration strategy now.

🚨 Don’t procrastinate – quantum computing is coming sooner than you think.

💻 More Resources: Visit Threat-Talks.com to stay informed on quantum computing and its impact on cybersecurity.

📢 Like, Subscribe & Share – Help us spread the word about preparing for the quantum age!=== ► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520👕 Receive your Threat Talks T-shirthttps://threat-talks.com/post-quantum-threat-to-encryption/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com/downloads/🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

🔒 Are endpoint protection solutions enough to safeguard your organization?

In this episode of Threat Talks – The Deep Dive, Rob Maas hosts Luca Cipriano, ON2IT’s Cyber Threat Specialist, to uncover the truth.

Learn✅ The differences between AVs, EDRs, and XDRs

✅ Common bypass techniques used by attackers

✅ Why defense-in-depth and Zero Trust are must-haves for any cybersecurity strategy

💡 Key Insights

• EDRs are essential but not invincible
• Combining smart tools with robust security practices is the winning strategy

📩 Have questions or thoughts?

Reach out at team@threat-talks.com!

🎙️ Follow Threat Talks for weekly cybersecurity insights.=== ► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520👕 Receive your Threat Talks T-shirthttps://threat-talks.com/breaking-the-defenses-edr-bypass/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com/downloads/🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Ever wondered what it’s like to see cybersecurity through a hacker’s eyes? In this episode of Threat Talks, Lieuwe Jan Koning talks with Tom van der Wiele, ethical hacker and founder of Hacker Minded, about how cybercriminals operate and how businesses can defend themselves.

📌 What You’ll Learn:

• The psychology and strategies of hackers• How AI enhances attacks and its implications for defenders
• Common vulnerabilities organizations overlook
• Why Zero Trust is critical for modern security
• Building a proactive security culture in your organization

With over two decades of experience, Tom offers unique perspectives on staying one step ahead in the ever-evolving world of cybersecurity.

🎯 Don’t forget to like, share, and subscribe to stay informed on the latest cybersecurity insights. New episodes every Tuesday! === ► YOUTUBE: https://youtube.com/@ThreatTalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E ► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520 👕 Receive your Threat Talks T-shirt https://threat-talks.com/inside-the-hackers-mind/

🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com/downloads/ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Salt Typhoon: Inside the Coordinated Breach of Nine Telecom Providers

A sweeping cyberattack, known as Salt Typhoon, has exposed the vulnerabilities of nine major telcos, leaving sensitive communications and surveillance data in the hands of attackers. How did this happen, and what lessons can we learn?

In this Threat Talks Deep Dive, host Lieuwe Jan Koning teams up with ON2IT’s Rob Maas (Field CTO) and Jeroen Scheerder (Security Researcher) to dissect every aspect of this high-profile breach.

🔍 What you’ll learn:

• How attackers exploited known vulnerabilities in Exchange servers, VPNs, and firewalls to infiltrate systems.
• The risks associated with lawful interception systems and the exposure of call detail records (CDRs).
• Why legacy infrastructure remains a significant cybersecurity challenge for telecom providers.
• Actionable steps organizations can take to enhance defenses, including segmentation, behavioral monitoring, and Zero Trust frameworks.

This episode dives into the attack’s technical anatomy, discusses its implications for both governments and private organizations, and explores how individuals can secure their communications in an era of increasing surveillance.

Join us to understand how Salt Typhoon unfolded—and what it means for the future of telecom security.

🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: https://youtube.com/@ThreatTalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E ► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520 👕 Receive your Threat Talks T-shirt https://threat-talks.com/salt-typhoon-how-nine-telcos-were-compromised/ 🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com/downloads/

🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Boards don’t buy dashboards—they buy assurance. Breaches are late-stage symptoms of drift: rules pile up, logs lose signal, cloud/Kubernetes outpace governance. Lieuwe Jan Koning (ON2IT Co-Founder) and Rob Maas (Field CTO) show how Zero Trust Step 5B (Maintain) proves your controls still work—today.

• (00:00) - — Welcome & Zero Trust Step 5B
• (00:57) - — Five steps: fast recap
• (03:12) - — Maintain = policy validation
• (05:31) - — Vendor updates, hidden features
• (08:46) - — Traffic flows vs. reality
• (10:19) - — Behavior analytics, baselines
• (11:56) - — Cloud/K8s/service-mesh shifts
• (16:32) - — Wrap-up & next actions

Related ON2IT Content & Referenced Resources
• Threat Talks homepage: https://threat-talks.com/
• ON2IT Zero Trust: https://on2it.net/zero-trust/ 

Zero Trust Series
Step 1: https://youtu.be/mC66i-tEEFs
Step 2: https://youtu.be/wp0q9aZHuXc
Step 3: https://youtu.be/eGsw2JCnrac
Step 4A: https://youtu.be/qT_nqbBEkVw
Step 4B: https://youtu.be/fnKyMITZes8
Step 5A: https://youtu.be/N7pWXLxI6kY

Guest and Host Links:
Lieuwe Jan Koning (ON2IT Co-Founder): https://www.linkedin.com/in/lieuwejan/ 
Rob Maas (Field CTO, ON2IT): https://www.linkedin.com/in/robmaas83/ 

If this helped you strengthen your Zero Trust policy, subscribe, like, and share. New episodes weekly. Follow Threat Talks on YouTube, Spotify, and Apple Podcasts.

Click here to view the episode transcript.

🔔 Follow and Support our channel! 🔔
=== 
► YOUTUBE: https://youtube.com/@ThreatTalks
► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E
► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520

👕 Receive your Threat Talks T-shirt
https://threat-talks.com/

🗺️ Explore the Hack's Route in Detail 🗺️
https://threat-talks.com

🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

ONCD: The Cyber Catalyst with Davis Hake

How can governments lead the charge in global cybersecurity efforts? In this compelling episode of Threat Talks, host Lieuwe Jan Koning sits down with returning guest Davis Hake, cybersecurity expert and advisor, to explore the critical role governments play in the cyber landscape.

👾 The ONCD’s mission and its role in U.S. cybersecurity.

👾 Lessons from the Biden administration’s approach to combating ransomware and cybercrime.

👾 Why global collaboration is key to countering modern threats.

Watch now to uncover how governments and businesses can work together to secure the digital future.

🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: https://youtube.com/@ThreatTalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E ► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520 👕 Receive your Threat Talks T-shirt 👕 https://threat-talks.com/oncd-the-cyber-catalyst/ 🗺️ Explore 2024's Hack's Routes in Detail 🗺️ https://threat-talks.com/downloads/ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

The State of Cybersecurity in the European Union

Cyber threats know no borders, and in the European Union, harmonizing cybersecurity efforts across 27 member states is no small feat. In this episode of Threat Talks, host Lieuwe Jan Koning speaks with Hans de Vries, Chief Cybersecurity and Operational Officer at ENISA, about the critical work being done to secure Europe’s digital future.

📌 Topics covered

• How ENISA supports EU member states in managing cyber incidents and crisis responses.
• The implementation of the NIS2 directive and upcoming Cyber Resilience Act.
• The role of trust and collaboration in cross-border cybersecurity.
• Why public-private partnerships are key to tackling cybersecurity challenges.

🎥 Watch now to explore how Europe is building a safer digital environment for its citizens and businesses.

👉 Don’t forget to like, subscribe, and share to help us spread the word!

2025: The Year of AI and Cybersecurity Evolution

Kick off 2025 with the latest insights from Threat Talks! In this episode, host Lieuwe Jan Koning sits down with Peter van Burgel, CEO of AMS-IX, to discuss how AI and cybersecurity are reshaping the landscape this year.

🚀 What’s inside this episode?

🔹 A sneak peek into AI advancements: Could we see virtual CEOs?

🔹 The rise of Zero Trust supply chain strategies.

🔹 Navigating the skills gap in an evolving digital world.

🔹 AI in cybersecurity: Opportunities, risks, and where to focus.

🔹 Power consumption and sustainability in AI’s rapid growth.

AMS-IX's role as a critical part of internet infrastructure and its cybersecurity responsibilities highlight the importance of collaboration and awareness in today’s complex geopolitical climate.

Follow and Support our channel! 🔔 === ► YOUTUBE: https://youtube.com/@ThreatTalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E ► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520 👕 Receive your Threat Talks T-shirt https://threat-talks.com/cyber-outlook-2025-one-year-of-threat-talks/ 🗺️ Explore all 2024's Hack's in Detail 🗺️ https://threat-talks.com/downloads/ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

🎥 Threat Talks - One Year of Insights with Peter van Burgel, CEO of AMS-IX As 2024 comes to a close, we’re celebrating a year of transformative conversations with a special edition of Threat Talks! Join Lieuwe Jan Koning and Peter van Burgel, CEO of AMS-IX, as they reflect on the past year’s most significant developments in cybersecurity and the lessons learned. In this Threat Talk, we: 👾 Look back at the major trends and threats of 2024. 👾 Discuss how organizations adapted to an ever-changing security landscape. 👾 Highlight key moments from Threat Talks throughout the year. Whether you're a cybersecurity enthusiast, a tech professional, or simply curious about how to safeguard the digital future, this episode is packed with insights you won't want to miss! 🔔 Don’t forget to like, subscribe, and hit the notification bell to stay updated with future episodes of Threat Talks. 👉Best way to support the channel: give us a like! 🎧 Available on all major podcast platforms. ► YOUTUBE: ⁠https://youtube.com/@ThreatTalks ⁠ ► SPOTIFY: ⁠https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E ⁠ ► APPLE: ⁠https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520 ⁠ 👕 Receive your Threat Talks T-shirt 👕 ⁠https://threat-talks.com/2024-the-breaking-point/

🗺️ Explore all 2024's infographics 🗺️ https://threat-talks.com/downloads/ 🕵️ Threat Talks is a collaboration between ON2IT and AMS-IX

Imagine the names, job functions, email addresses and phone numbers of police officers, DAs, and even critical key witnesses being hacked and leaked to the public. This isn’t the opening to some spy novel – it’s what actually happened when the Dutch Law Enforcement suffered a serious data breach in September of this year. Initially reported as a breach ‘only’ involving personal data of 65.000 law enforcement employees, it later became clear that much more data was leaked - and not just data from law enforcement personnel. In this Deep Dive, host Lieuwe Jan Koning, Security Expert Jeroen Scheerder and Field CTO Rob Maas take an in-depth look at how this breach unfolded, the poor security track record of the software that was used and what the Dutch Law Enforcement could’ve done better when it comes to handling the publicity of a data breach. 👉Best way to support the channel: give us a like! 🎧 Available on all major podcast platforms. ► YOUTUBE: https://youtube.com/@ThreatTalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E ► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520 👕 Receive your Threat Talks T-shirt 👕 https://threat-talks.com/prevent-pay-or-insure/ 🗺️ Explore the Hack's Route in Detail 🗺️ https://on2it.s3.us-east-1.amazonaws.com/Threat-Talks-Prevent-Pay-or-Insure.pdf 🕵️ Threat Talks is a collaboration between ON2IT and AMS-IX

🌎 Conti Attack on Costa Rica: When Ransomware Halts a Nation 🌎

What happens when a ransomware group attacks an entire country? In this Threat Talk, we dive deep into the Conti ransomware attack that crippled the Costa Rican government. From healthcare systems shutting down to unpaid government salaries and even tax collection grinding to a halt—this unprecedented cyberattack became a national emergency with global implications.

Join Lieuwe Jan Koning as he unpacks the timeline, impact, and lessons learned from this catastrophic event. Discover the vulnerabilities that allowed this to happen, the strategies used by Conti, and how governments and organizations worldwide can prepare for such sophisticated cyber threats.

💡 What You’ll Learn in This Episode

• ✔️ The inner workings of the Conti ransomware group
• ✔️ How critical infrastructure became a target
• ✔️ The economic and societal ripple effects of a national cyberattack
• ✔️ Best practices for defending against ransomware threats

🔒 Who Should Watch?

• ↠ Cybersecurity experts
• ↠ IT professionals
• ↠ Government leaders
• ↠ Business executives
• ↠ Anyone passionate about protecting digital assets and critical systems

🚀 Don’t miss this in-depth analysis of one of the most talked-about ransomware attacks in recent history! Subscribe now to Threat Talks for more cutting-edge discussions on cybersecurity, threat intelligence, and digital defense strategies.

👉 Support the channel: give us a like!

🎧 Available on all major podcast platforms.

► YOUTUBE: https://youtube.com/@ThreatTalks

► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E

► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520

🎙 Threat Talks: Unpacking the MGM Resorts ALPHV/BlackCat Ransomware Attack 🕵️‍♂️

In this Threat Talk, we dive deep into a cybersecurity incident in 2023: the MGM Resorts ransomware attack by ALPHV/BlackCat and Scattered Spider. From sophisticated social engineering tactics to deploying a shadow identity provider for persistence, this attack demonstrates the capabilities of collaborating ransomware groups.

Join cybersecurity experts Lieuwe Jan Koning, Luca Cipriano (Threat Intel Specialist), and Rob Maas (Field CTO) as they break down:

• 🔒 How attackers exploited MGM’s Okta environment.
• 🎯 The role of phishing and advanced persistence techniques.

• 🚨 Lessons learned and actionable steps to prevent such attacks.

 

Key Insights

• ➡ Why Zero Trust and network segmentation are critical.
• ➡ The dilemma of paying ransoms vs. operational downtime.
• ➡ Practical steps to improve your organization’s ransomware defense strategy.

If you’re a cybersecurity professional or just curious about the latest in cyber threats, this episode is a must-watch. Stay informed, stay secure! 💻

 

 👉 Support the channel: don’t forget to LIKE, COMMENT, and SUBSCRIBE :).

🎧 Available on all major podcast platforms.

► YOUTUBE: https://youtube.com/@ThreatTalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E ► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520

👕 Receive your Threat Talks T-shirt 👕

https://threat-talks.com/prevent-pay-or-insure/

🗺️ Explore the Hack's Route in Detail 🗺️

https://on2it.s3.us-east-1.amazonaws.com/Threat-Talks-Prevent-Pay-or-Insure.pdf

🕵️ Threat Talks is a collaboration between ON2IT and AMS-IX

💰Prevent, Pay or Insure? 💰

Days before MGM’s computer systems were taken down in a cyberattack, fellow casino operator Caesars paid a $15 million ransom to attackers who infiltrated its systems.

MGM chose not to pay and dealt with different costs because of it - did the two casino giants wind up paying similar amounts down the line? And what role does cybersecurity insurance play in these scenarios?

In this episode of Threat Talks, host Lieuwe Jan Koning and special guest David Hake (co-founder of Resilience, professor of Cyber Risk Management at UC Berkeley and advisor at Venable LLP) discuss these cyberattacks on MGM and Caesars, exploring how organizations can better prepare for and respond to ransomware incidents.

Dialing in to the conversation, Threat Intel Specialist Luca Cipriano offers a preview of our Deep Dives into three critical threats relevant to these attacks, providing valuable technical insights.

The by now age-old dilemma remains: should companies pay ransom or refuse? But beyond that, how can they focus on prevention? And where does cybersecurity insurance fit into the equation?

If businesses insure their personnel, facilities, and revenue, isn’t it time to also insure their cybersecurity?

🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: https://youtube.com/@ThreatTalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E ► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520

👕 Receive your Threat Talks T-shirt 👕 https://threat-talks.com/prevent-pay-or-insure/

🗺️ Explore the Hack's Route in Detail 🗺️https://on2it.s3.us-east-1.amazonaws.com/Threat-Talks-Prevent-Pay-or-Insure.pdf

🕵️ Threat Talks is a collaboration between ON2IT and AMS-IX

"Hello! I'm a Printer! Please Let Me In!"

“Hello! I’m a printer! Please let me enter, thank you!” – It may sound absurd, but this is how attackers can trick your Linux systems through the cups-browsed service..

 

In this latest Threat Talk, Lieuwe-Jan Koning reveals, with ON2IT’s Rob Maas and Luca Cipriano how a seemingly harmless printer can turn into a hacker’s gateway to your network.

 

With open ports and weak default configurations, your Linux environment could be more exposed than you think.

 

🔒 Tune in to learn how these vulnerabilities can be exploited and, more importantly, what steps you can take to secure your systems. Don’t wait until it’s too late!

 

📊 Bonus Resource: We’ve created an in-depth infographic breaking down these hacks in detailed illustrations—an invaluable tool for all security information professionals!

https://on2it.s3.us-east-1.amazonaws.com/Infographic-security-fallacies.pdf

🔔 Hit that subscribe button and show your support! 🔔 === ► YOUTUBE: https://youtube.com/@ThreatTalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E ► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520 👕 Receive your Threat Talks T-shirt https://threat-talks.com/breaking-the-illusion-exposing-security-fallacies/ 🕵️ Threat Talks is a collaboration between ON2IT and AMS-IX #CUPS #cybersecurityexperts #printers #threattalks eatTalks #techsafety #securitymatters #threatintelligence #cybersecurityexperts #unix

⏰ How much time would you spend on executing the perfect hack? ⏰  

The user going by the name of ‘JIAT75’ spent almost three years infiltrating and contributing to a GitHub repo for one singular reason – access to release manager rights for the next XZ Utils update.

In this episode of Threat Talks, host Lieuwe Jan Koning is joined by Thomas Manolis, Information Security Officer at AMS-IX, and Jeroen Scheerder, Security Specialist at ON2IT, to discuss this meticulously executed breach in the open-source community.

 

Using clever social engineering tactics, Jia Tan (JIAT75) built a credible reputation within said community, gaining trust and access to introduce malicious code undetected. The breach was only discovered by chance when Andres Freund, an engineer at Microsoft, traced unusual system latency back to XZ Utils and uncovered the backdoor.

 

What exactly happened?

How lucky did we get with Freund discovering the backdoor? And how do we know that something like this hasn’t happened before?

🔔 Follow to Support our channel! 🔔 ► YOUTUBE: https://youtube.com/@ThreatTalks

► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E

► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520

🗾 Explore the XZ Utils Critical Backdoor Details 🗾

https://on2it.s3.us-east-1.amazonaws.com/Infographic-security-fallacies.pdf

Our exclusive infographic maps out the step-by-step tactics hackers use to exploit these vulnerabilities. Perfect for IT teams and Information Security Officers, it’s designed to help you stay one step ahead.

 

👕 Get your own Threat Talks T-shirt

https://threat-talks.com/breaking-the-illusion-exposing-security-fallacies/

 

🕵️ Threat Talks is a collaboration between ON2IT and AMS-IX

===

#ThreatTalks #ON2IT #Cybersecurity #Fallacies #CrowdStrike #SecurityMatters

Hacktivists don’t need zero-days to hurt you—they weaponize people. Host Lieuwe Jan Koning sits down with Yuri Wit (SOC analyst) and Rob Maas (Field CTO) to dissect APT Handala: how they hunt targets, deliver wipers, and brag about leaks. We map their moves to the Lockheed Martin Kill Chain and turn it into a Zero Trust defense playbook you can actually use—today.

• (00:00) - - 01:40 - Introduction
• (01:40) - - 02:27 - What is APT Handala?
• (02:27) - - 05:27 - Kill Chain Step 1: Reconnaissance
• (05:27) - - 06:43 - Kill Chain Step 2: Weaponization
• (06:43) - - 10:39 - Kill Chain Step 3: Delivery
• (10:39) - - 14:37 - Kill Chain Step 4: Exploitation
• (14:37) - - 17:34 - Kill Chain Step 5: Installation
• (17:34) - - 23:39 - Kill Chain Step 6: Command and control
• (23:39) - - 26:40 - Kill Chain Step 7: Act on objectives
• (26:40) - - 29:35 - How to respond to being hacked
• (29:25) - - 30:22 - Closing notes

Key Topics Covered
•  Handala’s playbook: people-centric recon, phishing kits, wipers, boast-and-leak ops.
•  Zero Trust counters: deny-by-default egress, newly-registered-domain blocks, hard EDR, passkeys.
•  SOC tells: DNS DGA spikes, encrypted C2 on common apps, “human error” as the biggest CVE.
•  Comms reality: when openness helps—and when strategic silence limits amplification.

Additional Resources
• ON2IT Zero Trust: https://on2it.net/zero-trust/
• Lockheed Martin Cyber Kill Chain: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
• Tor Project (onion services): https://www.torproject.org/
• Threat Talks hub: https://threat-talks.com/

Click here to view the episode transcript.

🔔 Follow and Support our channel! 🔔
=== 
► YOUTUBE: https://youtube.com/@ThreatTalks
► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E
► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520

👕 Receive your Threat Talks T-shirt
https://threat-talks.com/

🕵️ Threat Talks is a podcast created in collaboration with ON2IT and AMS-IX. Each episode features leading cybersecurity experts sharing real-world insights on emerging threats, trends, and defense strategies — helping organizations stay secure in today’s rapidly evolving digital world.

ON2IT website: https://on2it.net/
AMS-IX website: https://www.ams-ix.net/ams

☠️ CrowdStrike: 8.5 million blue screens of death ☠️

Did you know that last July’s CrowdStrike outage led to closed airports, inaccessible bank accounts and hospitals that were only delivering emergency care that did not require any computers?

 

In this Threat Talk, Lieuwe Jan Koning is joined by Rob Maas and Jeroen Scheerder as they discuss the CrowdStrike outage and, more importantly, what could have been done to prevent such an impactful event from happening in the first place.

 

What exactly are the inherent risks of automatic updates? And can they be set up in such a way that what happened with CrowdStrike won’t happen again?

🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: https://youtube.com/@ThreatTalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E ► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520 👕 Get your own Threat Talks T-shirt

https://threat-talks.com/breaking-the-illusion-exposing-security-fallacies/

🗾 Explore the CrowdStrike Outage's Details 🗾
Our exclusive infographic maps out the step-by-step tactics hackers use to exploit these vulnerabilities. Perfect for IT teams and Information Security Officers, it’s designed to help you stay one step ahead.

https://on2it.s3.us-east-1.amazonaws.com/Infographic-security-fallacies.pdf 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

🔍 Breaking the Illusion: Confronting Cybersecurity’s Biggest Fallacies 🔍

Think you know the route a hacker might take? Think again! In this eye-opening Threat Talk, Lieuwe Jan Koning dives into the critical fallacies of cybersecurity with top experts Fleur van Leusden, CISO and host of CISO Praat, and Jeroen Scheerder.

✨ Fleur unpacks one of the industry’s biggest blind spots: the heavy reliance on user awareness as a defense mechanism. While user education has its place, she argues it’s not enough to withstand today’s sophisticated threats. Instead, Fleur and Jeroen explore the essential need for technical controls and resilient systems that go beyond awareness alone.

🔥 Rethink conventional strategies, dissect the recent CrowdStrike auto-update disaster, the XZ Utils backdoor (CVE-2024-3094), and a UNIX CUPS vulnerability 🖨️—revealing why proactive, layered defenses are the only way forward.

Don’t miss this essential discussion on the true foundations of cybersecurity! 🛠️🔒

===

🗺️ Explore the Hack's Route in Detail 🗺️ Our exclusive infographic maps out the step-by-step tactics hackers. Perfect for IT teams and Information Security Officers.

https://on2it.s3.us-east-1.amazonaws.com/Infographic-security-fallacies.pdf

👕 Receive your Threat Talks T-shirt https://threat-talks.com/breaking-the-illusion-exposing-security-fallacies/

#ThreatTalks #ON2IT #Cybersecurity #Fallacies #CrowdStrike #UNIXCUPS #XZUtils #SecurityMatters

Imagine creating millions in cryptocurrency…without spending a cent. 💸

🔍 Explore the Binance BNB Chain Attack, where attackers used cross-chain bridges to create crypto assets out of thin air.

👾 Dive into the exploit’s details, from blockchain’s cryptographic structures to vulnerabilities in cross-chain transfers. With breakdowns of Merkle trees and validation flaws, this discussion reveals how even minor misconfigurations can lead to massive security gaps.

🔍 Curious about blockchain risks and crypto asset security? Want to gain insight into safeguarding assets in a digital-first world? >> Check this episode!

=== 📈 Download the infographic

https://on2it.s3.amazonaws.com/Infographic-breaking-the-bank.pdf

👕 Request your own Threat Talks T-shirt

⁠https://threat-talks.com/breaking-the-bank/

🕵️ Threat Talks is a collaboration between ON2IT and AMS-IX.

𝐄𝐯𝐞𝐫 𝐛𝐞𝐞𝐧 𝐚𝐬𝐤𝐞𝐝 𝐭𝐨 𝐡𝐚𝐜𝐤 𝐚 𝐛𝐨𝐚𝐭? When Luca Cipriano and Jeroen Scheerder were given the challenge, they took an unexpected approach—step one: build the boat themselves. It was a scale model, but they made sure it closely mirrored a real boat’s systems. With help from Damen Shipyards engineers, they even included a working ballast system. Of course the next step was to hack said ballast system. In this Threat Talks episode, Lieuwe Jan Koning chats with Luca and Jeroen about building the boat, why they did it, the fun they had along the way and whether or not their plan worked. They also dive into how they hacked the ballast system and how such an attack could’ve been prevented. 𝐃𝐨𝐧’𝐭 𝐦𝐢𝐬𝐬 𝐨𝐮𝐭! 🔔 𝘚𝘶𝘣𝘴𝘤𝘳𝘪𝘣𝘦 🔔 and stay tuned for fascinating deep dives into the world of cybersecurity. === -- 🌎 -- threat-talks.com -- 📈 -- Threat Talks infographics -- 👕 -- Receive your own Threat Talks T-shirt 🕵️ Threat Talks is a collaboration between ON2IT and AMS-IX