Summary:

In this enlightening episode of the Exploring Information Security podcast, we dive deep into the world of deepfakes with Dr. Donnie Wendt. With a background in cybersecurity at MasterCard, Dr. Wendt shares his journey into the exploration of deepfake technology, from setting up a home lab using open-source tools to presenting the potential business impacts of deepfakes to leadership teams.

Key Discussions:

• What are Deepfakes? Dr. Wendt explains the basics of deepfakes, a technology that uses machine learning to superimpose someone's likeness onto another person, creating realistic fake videos or audio recordings. Initially used for nefarious purposes, the technology has found applications in politics, social engineering, and entertainment.

• Creating Deepfakes: Discover how Dr. Wendt utilized open-source tools and a good Nvidia video card to experiment with deepfake creation, including making Nicholas Cage a regular "guest" in security briefings at MasterCard.

• The Threat Landscape: Dr. Wendt discusses the use of deepfakes in political manipulation and fraud, highlighting recent instances where deepfakes have influenced elections and scammed individuals and businesses out of large sums of money.

• Detection and Prevention: The conversation touches on the challenges of distinguishing deepfakes from real footage, emphasizing the importance of skepticism, critical thinking, and verification processes to combat misinformation.

• Positive Applications: Despite their potential for misuse, deepfakes also have beneficial uses, such as giving voice back to ALS patients, recreating historical speeches, and aiding medical diagnosis. Dr. Wendt stresses the importance of recognizing the technology's positive impact alongside its threats.

Episode Highlights:

• Dr. Wendt's firsthand experience with creating deepfakes and the technical requirements for doing so.

• Insight into the evolving capabilities of deepfake technology and the cat-and-mouse game between creators and detectors.

• The significance of robust verification processes within organizations to safeguard against deepfake-related fraud.

Resources Mentioned:

• Faceswap.dev: An open-source tool for experimenting with different deepfake creation algorithms.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

Subscribe

Sign up with your email address to receive news and updates.

We respect your privacy.

Summary:

In this compelling episode of the Exploring Information Security podcast, we sit down with Joe Weiss, a seasoned expert in control systems security, to unravel the complexities and challenges facing the security of Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems today.

Key Topics Discussed:

• Understanding SCADA/ICS: Joe Weiss provides an in-depth explanation of what SCADA and ICS are, emphasizing their critical role in monitoring and controlling physical processes across various industries, from utilities to manufacturing.

• The Security Gap: Weiss outlines the fundamental security gap existing between traditional IT cybersecurity measures and the unique needs of control systems. He highlights the dire consequences of neglecting the security of these systems, including potential physical damage and disruptions to critical infrastructure.

• Bridging the Divide: The conversation delves into the challenges of bridging the knowledge and communication gap between IT professionals and engineers. Weiss stresses the importance of integrating engineering insights with cybersecurity practices to protect control systems effectively.

• Historical Oversights and Current Challenges: Reflecting on over two decades of experience, Weiss discusses how historical oversights and the prioritization of IT security have led to vulnerabilities in control systems. He calls for a paradigm shift in how organizations and governments approach the cybersecurity of physical infrastructure.

• Future Outlook and Solutions: Looking ahead, Weiss offers insights into the future of control systems security, advocating for education, awareness among senior management, and the need for a holistic approach that encompasses both the digital and physical aspects of security.

Episode Highlights:

• A Call to Action for Senior Management: Weiss underscores the critical need for senior management in both the private and public sectors to recognize the existential threat posed by inadequate control systems security.

• The Importance of Engineering Knowledge: The discussion emphasizes the need for cybersecurity professionals to possess a foundational understanding of engineering principles to secure control systems effectively.

• Practical Steps Forward: Weiss suggests practical steps for improving the security posture of control systems, including enhancing cross-disciplinary education, fostering collaboration between IT and engineering teams, and adopting security measures tailored to the unique characteristics of control systems.

Resources:
Blog: Control Global - Unfettered

Applied Control Systems

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

Subscribe

Sign up with your email address to receive news and updates.

We respect your privacy.

Summary:

Hacker Jeff Man

Welcome to a special edition of the Exploring Information Security podcast, where we dive into the intricacies of cybersecurity with industry veteran Jeff Man! A distinguished figure in cybersecurity Jeff has a wealth of experience that spans over four decades, including his early years at the National Security Agency and extensive work in the private sector.

This podcast sponsored by ShowMeCon.

Key Discussions:

• Jeff's Journey: From his initial steps in the cybersecurity realm at the NSA to becoming a pivotal player in the payment card industry, Jeff shares his rich journey and the lessons learned along the way.

• The Essence of PCI DSS 4.0: With the imminent rollout of PCI DSS version 4.0, Jeff breaks down the major changes and what organizations need to focus on to remain compliant. He emphasizes the shift towards continuous security practices over checkbox compliance.

• Tales from the Crypt(analyst): Jeff gives us a sneak peek into his upcoming keynote at ShowMeCon, titled "Tales from the Crypt(analyst)," where he'll explore his cybersecurity adventures and the evolution of cyber threats and defenses over the years.

• The Cloud Misconception: A discussion on common misconceptions about cloud security and the continuous responsibility of organizations to secure their cloud environments.

• PCI as a Framework for Critical Infrastructure: Jeff argues that the PCI DSS, often seen merely as a compliance standard, holds the potential to serve as a robust security framework for various industries, including critical infrastructure.

Episode Highlights:

• Advice from a Veteran: Jeff shares invaluable insights on the importance of understanding cybersecurity history to better navigate current and future challenges.

• The Reality of Compliance and Security: Through anecdotes and personal experiences, Jeff illustrates the often-overlooked aspects of implementing and maintaining security measures effectively.

• A Look Ahead: With PCI DSS 4.0 set to redefine compliance standards, Jeff offers practical advice for organizations to adapt and evolve their security posture.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

Subscribe

Sign up with your email address to receive news and updates.

We respect your privacy.

Summary:

Jayson E. Street

In this engaging episode Jayson E. Street, a renowned cybersecurity expert, joins me to discuss the return of ShowMeCon, the impact of AI in cybersecurity, and innovative strategies for enhancing security and combating threats. Jayson shares his excitement for ShowMeCon, insights on utilizing AI for security enhancements rather than traditional attacks, and offers practical advice for users, executives, and information security professionals.

This podcast sponsored by ShowMeCon.

Episode Highlights:

• ShowMeCons return

• Utilizing AI in Cybersecurity

• Creative Use of AI for Security

• Practical Security Tips Across the Board

• The Future of AI in Security

Guest Information:

Jayson E. Street referred to in the past as: A "notorious hacker" by FOX25 Boston, "World Class Hacker" by National Geographic Breakthrough Series and described as a "paunchy hacker" by Rolling Stone Magazine.

He however prefers if people refer to him simply as a Hacker, Helper & Human.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

Subscribe

Sign up with your email address to receive news and updates.

We respect your privacy.

Scott Miller

Summary:

Scott Miller, a fresh voice in the cybersecurity arena, joins me to discuss the intricacies of hacking Azure services. Scott shares his journey from a recent college graduate to becoming a speaker at cybersecurity conferences, along with valuable insights into Azure AD (Active Directory), vulnerabilities within cloud services, and the art of escalation.

This episode sponsored by ShowMeCon.

Episode Highlights:

• Scott's Entry into Cybersecurity

• Focus on Azure AD

• Exploring Vulnerabilities

• Methodology and Tools

• Learning and Resources

• The Importance of Entry-Level Accessibility

Scott Miller Penetration Tester at Accenture

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

Subscribe

Sign up with your email address to receive news and updates.

We respect your privacy.

Paul Coggin

Summary:

In this captivating episode of the "Exploring Information Security" podcast, cybersecurity expert Paul Coggin discusses the intricate world of threat hunting in SCADA networks and the emerging frontier of space cybersecurity. From the inspiration drawn from Transformers movies to the sophisticated attacks like Stuxnet, Coggin delves deep into how monitoring physical indicators could revolutionize our approach to cybersecurity in both terrestrial and extraterrestrial domains.

This podcast is sponsored by ShowMeCon.

Episode Highlights:

• The significance of ShowMeCon in filling the void left by other conferences.

• Paul's historical involvement and contribution to the naming of ShowMeCon and DerbyCon.

• The Internet of Military Things

• Initiating Threat Hunting in New Domains

• Case Studies and Practical Applications

• Looking Ahead: Cybersecurity in Space

Guest Information:

Paul Coggin is a Cyber SME at nou Systems, Inc.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

Subscribe

Sign up with your email address to receive news and updates.

We respect your privacy.

Arnar Gunnarsson

Summary:

Arnar is not a speaker this year at ShowMeCon but he will be in attendance. He doesn’t work in the security field but he’s doing some really advanced stuff with cooling in cloud environments. We get into a little bit of everything around what he’s doing as well as talk about AI. Surprise!

This podcast is sponsored by ShowMeCon.

Episode Highlights:

• What Arnar is looking forward to at ShowMeCon

• Some of the cool things he’s doing with his company

• AI

Guest Information:

Arnar

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

Subscribe

Sign up with your email address to receive news and updates.

We respect your privacy.

Amanda Berlin

Summary:

Amanda Berlin is Lead Incident Detection Engineer at Blumira, where she leads the development of new detections for the Blumira platform, based on threat intelligence and research. In this episode I catch up with her to talk about Sysmon and ShowMeCon. Sysmon is such a great tool for getting more information out of your systems. The best part is it’s free.

This podcast is sponsored by ShowMeCon.

Episode Highlights:

• What is Sysmon

• How to use Sysmon

• ShowMeCon

Guest Information:

Amanda Berlin is Lead Incident Detection Engineer at Blumira

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

Subscribe

Sign up with your email address to receive news and updates.

We respect your privacy.

Summary:

Veteran conference speaker Johnny Xmas joins me to discuss ShowMeCon and his talk Couch to Compromise the 2024 edition. His talk is an update from previous years which goes over the latest attacks impacting organizations.

Episode Highlights:

Johnny Xmas with a not a flamethrower

• ShowMeCon

• Couch to Compromise 2024 talk

Guest Information:

Johnny Xmas: The Most Interesting Man in Information Security

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

Subscribe

Sign up with your email address to receive news and updates.

We respect your privacy.

Summary:

Shameer Amir AKA Titan joins me to discuss his upcoming talk on his research into bypassing multifactor authentication (MFA) at the upcoming ShowMeCon conference. In this episode we talk about a variety of different ways of bypassing MFA from human interaction to more technical interactions with the platforms. A lot of what it comes down to is making sure MFA is setup properly.

Episode Highlights:

• Why this talk

• Response manipulation

• SIM jacking

• Misconfigurations

Guest Information:

Shameer Amir AKA Titan is a globally recognized bug hunter

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

Subscribe

Sign up with your email address to receive news and updates.

We respect your privacy.

Summary:

Micah Hoffman and Griffin Glynn from My OSINT Training join me to talk about the current state of OSINT. Both bring a wealth of knowledge and first meet while working together at the National Child Protection Task Force. They bring a wealth of knowledge and we get into a lot of the ins and outs of OSINT.

Episode Highlights:

• What is OSINT?

• What tools are used for OSINT

• Social media changes?

• How do APIs play into OSINT?

• How is AI impacting OSINT?

Guest Information:

Micah Hoffman and Griffin Glynn co-owners of My OSINT Training environment and co-workers at National Child Protection Task Force (NCPTF)

https://twitter.com/myosinttrainer

https://www.linkedin.com/company/my-osint-training

https://www.myosint.training

Resources and Mentions:

• Free OSINT Newsletter

• Free intro to OSINT course

• The Ultimate OSINT Collection

• Cloud browser desktop for OSINT

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

Subscribe

Sign up with your email address to receive news and updates.

We respect your privacy.