Privacy and Surveillance
Easy Prey
Ever had that creepy feeling someone's watching you online? Now imagine if that feeling was actually your reality, not just your browsing history being tracked, but cameras following your every move on the street, your conversations being monitored, your payments scrutinized. For our guest Josh Summers, this wasn't some dystopian nightmare, it was his daily life. Josh isn't your typical privacy advocate. As the creator behind All Things Secured (both a website and YouTube channel), his passion for digital privacy was forged through nearly 20 years living abroad, much of it in China. There, he...
info_outline
Navigating Data Brokering and Privacy
Easy Prey
In a world where data is more important than ever, understanding how it is acquired, shared, and misused is critical. Data brokers work behind the scenes, amassing enormous amounts of personal information from online activity, loyalty programs, and even public records, often without the users' knowledge. This data powers targeted marketing, scams, and even identity theft. But what can be done to regain control of personal privacy? Today we're diving deep into this topic with cybersecurity expert Darius Belejevas, who has spent years assisting folks in removing their data from these digital...
info_outline
Be Your Own Fraud Prevention Hero
Easy Prey
Getting defrauded is common. It happens everywhere but it’s underreported because of embarrassment. If you’re a victim of fraud the sooner you report the more likely you are to get a better outcome. To learn more about fraud I’m pleased to welcome Marc Evans, a seasoned financial crimes detective and co-founder of Fraud Hero, who has spent over a decade investigating fraud schemes that affect everyday people. With expertise in social engineering, money laundering and credit card scams he has spent his career uncovering the ways criminals use to exploit victims. His passion for fraud...
info_outline
Empowering the Vulnerable
Easy Prey
In cybersecurity, we need to understand the mindset of hacking, which is not ethics. We also need to realize that even if we have cybersecurity experts get hacked, there is no reason to feel embarrassed or ashamed when it happens to us. In today’s show we’re going deep into the world of cybersecurity with one of the industry’s most seasoned experts, Sam Curry. With over 30 years of experience in information security, Sam has been defending against cyber threats, shaping security strategies and mentoring the next generation of cyber professionals. Currently the Global VP and...
info_outline
How Not to Money with Joel Larsgaard
Easy Prey
Managing money isn’t about numbers, it's about making informed decisions that shape your future. Whether you’re a seasoned saver or just starting out on your financial journey understanding the basics of personal finance can make all the difference. Today’s guest Joel Larsgaard has been helping people take control of their finances for over 15 years. As the co-host of How To Money and a weekly radio show Joel breaks down the often confusing world of personal finance. His passion for financial literacy comes from personal experience and he’s been recognized for his work including being...
info_outline
Brushing Scams with Venkat Margapuri
Easy Prey
Scams come in many forms but receiving a freebie from a scammer doesn’t make sense. If something shows up at your door that you didn’t order, should you be worried? Brushing scams are becoming more common and while they may seem harmless at first they can be a gateway to fraud, identity theft and financial loss. Today we’re diving into how these scams work, why they exist and the real dangers behind them. Our guest is Dr. Venkat Margapuri, an assistant professor of computer science at Villanova University. His research focuses on AI applications in agriculture and healthcare but he’s...
info_outline
Ransomware, Phishing and Fraud
Easy Prey
Cybersecurity isn't just a concern for large corporations. It's vital for businesses of all sizes. It's essential for companies to know how to protect sensitive data, restore from backups, and regularly test their systems with internal pen tests to keep their teams safe. Today's guest is Bryce Austin. Bryce is the CEO of TCE Strategy, a cybersecurity advisory firm. They provide vulnerability scans, penetration tests, fractional CISO services, and incident response services. He is also a professional speaker on ransomware. Bryce is the fractional CISO to many companies, including one on the...
info_outline
CISOs: The Ultimate Stress Test With Jill Knesek
Easy Prey
The CISO role is constantly changing. With all the shifts in cybersecurity, it's crucial to find ways to attract new talent to close the growing skills gap. CISOs now juggle complex systems managed at multiple levels and handle burnout amongst many other responsibilities. Today's guest is Jill Knesek. Jill is the Chief Information Security Officer for Blackline, a company that does financial SaaS solutions. It’s based out of the Los Angeles area. She’s been there almost three years now as the CISO, running the information security team. She previously served as Chief Security Officer for...
info_outline
AI, Automation, and the Future of Cybersecurity With Mike Lyborg
Easy Prey
With the increase in targeted cyber attacks, it's more important than ever for organizations to quickly identify and respond to threats. AI is helping security teams by acting as virtual analysts, handling much of the investigation work. However, human oversight is still essential for the final steps and judgment. Today's guest is Michael Lyborg. Michael is the Chief Information Security Officer at Swimlane. Prior to taking his current role, Michael was Global Vice President of Advisory Services, a highly sought-after expert by the world's largest Fortune 500 companies and global government...
info_outline
Cybersecurity Training from Boring to Engaging With Howard Goodman
Easy Prey
The landscape of cybersecurity training and collaboration is changing, interactive education sessions and cross team communication is key. Building a security culture and staying ahead of the modern threats has never been more important. Today’s guest is Howard Goodman, Senior Technical Director at Skybox Security. With over 20 years of experience Howard has become a well known figure in the cybersecurity world, he combines strategic planning with hands-on application across many industries. In this episode we talk about; security culture, the evolution of cybersecurity training and how...
info_outlineSecurity risks are dynamic. Projects, employees, change, tools, and configurations are modified. Many companies utilize PEN testers on an annual basis, but as quickly as systems are revised, you may need to implement threat emulation for regular monitoring.
Today’s guest is Andrew Costis. Andrew is the Chapter Lead of the Adversary Research Team at Attack IQ. He has over 22 years of professional industry experience and previously worked in the Threat Analysis Unit Team at Firmware, Carbon Black, and Logrhythm Labs, performing security research, reverse engineering malware, and tracking and discovering new campaigns and threats. Andrew has delivered various talks at DefCon, Adversary Village, Black Hat, B Side, Cyber Risk Alliance, Security Weekly, IT Pro, Bright Talk, SE Magazine, and others.
Show Notes:
- [1:14] - Andrew shares his background and what he currently does in his career at Attack IQ.
- [3:49] - At the time of this recording, there has been a major global security panic.
- [6:06] - There are many programs that we use on a regular basis that we don’t always consider the security of.
- [8:09] - Historically, companies would pay for an external pen test. Andrew describes the purpose of this and how they usually went.
- [9:33] - Pen tests and threat emulation do not need to be limited to just once a year.
- [10:45] - Andrew’s team is in the business of testing post-breached systems. But they preach prevention.
- [11:55] - Attackers are lazy in the sense that they will reuse the same strategies over and over again.
- [14:13] - Many programs we use may be caught in the crosshairs of attacks and vulnerabilities in other companies.
- [16:41] - Andrew discusses the frequency of really critical CVEs.
- [19:01] - What do attackers go after when they’ve breached a system?
- [21:04] - The priority for attackers is to get in quickly and make the victim’s data unavailable.
- [22:24] - A lot of people are under the impression of vulnerability testers. “Fire and forget it” is not a beneficial mindset.
- [24:56] - If we run every test, the amount of data will be overwhelming.
- [27:03] - In his experience, there has been client testing that has been overwhelmingly easy to breach.
- [29:07] - There are also organizations that have done a fantastic job. However, vulnerabilities will still be found.
- [30:18] - The red team is not going to be able to cover your entire organization.
- [32:15] - Threat emulation and pen testing are technically the same thing. Andrew explains how she sees the difference.
- [33:50] - How are vulnerabilities and tests prioritized?
- [36:19] - Andrew describes the things his team works on and their objectives for customers and clients.
- [38:34] - The outage at the time of this recording had a big impact. It gave a really good idea of what could happen if it were a real security breach.
- [41:37] - There are a ton of free resources out there. The primary resource at Attack IQ is the free Attack IQ Academy.
Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.