Exploring the Evolution of Zero Trust - BTS #53
Below the Surface (Audio) - The Supply Chain Security Podcast
Release Date: 07/07/2025
Netgear, Gigabyte, and Rowhammer Vulnerabilities - BTS #55
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode of Below the Surface, the hosts discuss critical cybersecurity topics including vulnerabilities in Netgear and Gigabyte devices, the importance of asset inventory, and the implications of Row Hammer attacks on memory integrity. They emphasize the need for organizations to implement compensating controls and monitor for potential threats, especially in the context of supply chain security and IoT devices. Chapters 00:00 Introduction to Cybersecurity Challenges 02:20 Exploring Netgear's Role in Enterprise Security 09:08 The Impact of Shadow IT on Network Security...
info_outline
CVE-2024-54085: The First of Its Kind - BTS #54
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts delve into the critical vulnerabilities associated with Baseboard Management Controllers (BMCs), with a particular focus on CVE-2024-54085. They discuss the ease of exploitation, the potential threat actors involved, and the implications for data center security. The conversation highlights the challenges in detecting and mitigating these vulnerabilities, the importance of firmware updates, and the need for community tools to aid in vulnerability detection and mitigation. The episode concludes with a call to action for organizations to patch their systems and...
info_outline
Exploring the Evolution of Zero Trust - BTS #53
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts discuss the evolving landscape of AI infrastructure security, focusing on the complexities of building and maintaining AI data centers. They explore the critical role of Baseboard Management Controllers (BMCs) as an attack surface, the importance of supply chain security, and best practices for hardware procurement. The conversation underscores the importance of validating hardware and firmware integrity for organizations while also addressing the significant security risks associated with AI workloads. As AI data centers continue to grow, understanding these...
info_outline
Securing the Future of AI Infrastructure - BTS #52
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts discuss the evolving landscape of AI infrastructure security, focusing on the complexities of building and maintaining AI data centers. They explore the critical role of Baseboard Management Controllers (BMCs) as an attack surface, the importance of supply chain security, and best practices for hardware procurement. The conversation underscores the importance of validating hardware and firmware integrity for organizations while also addressing the significant security risks associated with AI workloads. As AI data centers continue to grow, understanding these...
info_outline
When Windows 10 Expires - BTS #51
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts discuss the impending end of life for Windows 10 and the necessary preparations for upgrading to Windows 11. They explore the specific hardware requirements for Windows 11, including the importance of Secure Boot and TPM 2.0, and the challenges enterprises face in managing large-scale migrations. The conversation underscores the importance of meticulous planning to prevent costly failures and the influence of legacy systems on the upgrade process. In this conversation, the speakers discuss the implications of transitioning to Windows 11, focusing on the challenges...
info_outline
SBOMs, HBOMs, and Supply Chain Visibility - BTS #50
Below the Surface (Audio) - The Supply Chain Security Podcast
Summary In this episode, Paul Asadoorian and Joshua Marpet delve into the complexities of compliance, inventory management, and the emerging concepts of SBOMs, HBOMs, and FBOMs (no, not that FBOM). They discuss the importance of understanding the components and origins of hardware and software, the challenges of managing technology lifecycles, and the need for clear standards and regulations in the tech industry. The conversation emphasizes the critical role of asset inventories in maintaining security and compliance in an ever-evolving technological landscape. In this conversation, Joshua...
info_outline
The Hidden Risks of Open Source Components - BTS #49
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, Paul Asadorian and Josh Bressers delve into the complexities of open source supply chain security, discussing the prevalence of open source components in modern software, the challenges posed by legacy systems, and the critical importance of vulnerability management. They explore the regulatory landscape surrounding software liability and the need for better tools and practices to ensure secure product development. The conversation highlights the necessity of understanding dependencies and the implications of consumer security in a market driven by features rather than...
info_outline
Hardware Hacking Tips & Tricks - BTS #48
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, Paul and Chase delve into the world of hardware hacking, focusing on devices like the Flipper Zero and ESP32. They discuss the various applications of these tools, their impact on awareness in the hacking community, and the security implications surrounding their use. The conversation also touches on vulnerabilities in hotel security systems, challenges in remediating legacy systems, and the commoditization of hacking tools. Through practical examples and insights, the hosts explore the evolving landscape of cybersecurity and the role of hardware in it. In this conversation,...
info_outline
BMC&C Part 3 - BTS #47
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, Paul Asadoorian, Vlad Babkin, and Chase Snyder delve into the latest vulnerability disclosures related to Baseboard Management Controllers (BMCs), specifically focusing on AMI Megarac and Redfish. They discuss the nature of the vulnerabilities, the discovery process, and the potential impacts of a BMC compromise. The conversation highlights the importance of understanding BMCs in the context of supply chain security and the risks associated with exposing these components to the internet. The conversation delves into the vulnerabilities associated with Baseboard Management...
info_outline
Black Basta - Threat Intelligence Insights - BTS #46
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, Paul Asadoorian, Vlad Babkin, and Chase Snyder delve into the recent leaks from the Black Basta ransomware group, exploring the implications of the leaked chat logs, the operational tactics of the group, and the evolving landscape of ransomware attacks. The conversation highlights the importance of understanding threat intelligence derived from these leaks, the significance of targeting exposed devices, and the necessity of robust security measures to mitigate risks. In this conversation, the speakers delve into the evolving tactics of ransomware groups, emphasizing the...
info_outlineIn this episode, the hosts discuss the evolving landscape of AI infrastructure security, focusing on the complexities of building and maintaining AI data centers. They explore the critical role of Baseboard Management Controllers (BMCs) as an attack surface, the importance of supply chain security, and best practices for hardware procurement. The conversation underscores the importance of validating hardware and firmware integrity for organizations while also addressing the significant security risks associated with AI workloads. As AI data centers continue to grow, understanding these challenges and implementing robust security measures will be essential for future success.
Chapters
00:00 Introduction to Zero Trust and Its Evolution
03:33 Current State of Zero Trust Implementation
05:22 Micro-Segmentation and Infrastructure Security
10:02 Zero Trust and Lateral Movement Prevention
11:32 The Role of Zero Trust in Ransomware Defense
14:51 Chase Cunningham's Insights on Cyber Warfare
16:23 The Intersection of Cyber Warfare and Modern Conflicts
21:35 The Future of Warfare: Drones and Cybersecurity
24:01 Understanding the Drone Threat
28:28 The Evolution of Cyber Warfare
35:00 The State of Critical Infrastructure
39:26 The Economics of Breaches
44:29 Incentivizing Cybersecurity Improvements