))
The daily cybersecurity news and analysis industry leaders depend on. Published each weekday, the program also includes interviews with a wide spectrum of experts from industry, academia, and research organizations all over the world.
Deception, influence, and social engineering in the world of cyber crime.
A fun and informative cybersecurity audio glossary from the CyberWire.
Every Saturday, we sit down with cybersecurity researchers to talk shop about the latest threats, vulnerabilities, and technical discoveries.
C
Control Loop: The OT Cybersecurity Podcast
1
Control Loop: The OT Cybersecurity Podcast
CyberWire Inc.
Control Loop is the OT Cybersecurity Podcast, your terminal for ICS security, intelligence, and learning. Every two weeks, we bring you the latest news, strategies, and technologies that industry professionals rely on to safeguard civilization.
Step inside the diverse and fascinating worlds of cybersecurity professionals around the globe and hear their personal stories in their own words.
Encore seasons of the popular CyberWire Pro podcast hosted by Chief Analyst, Rick Howard. Join Rick and the Hash Table experts as they discuss the ideas, strategies and technologies that senior cybersecurity executives wrestle with on a daily basis. For the latest seasons ad-free along with essays, transcripts, and bonus content, sign up for CyberWire Pro.
Join us for thought provoking conversations on surveillance, digital privacy, and cybersecurity law and policy in the information age. Each week, hosts Dave Bittner and Ben Yelin break down the headlines, legal cases, and policy battles that matter most.
Get ready for a deep dive into what cybersecurity professionals often refer to as the "8th Layer" of security: HUMANS. Welcome to 8th Layer Insights (8Li). This podcast is a multidisciplinary exploration into how the complexities of human nature affect security and risk. Author, security researcher, and behavior science enthusiast Perry Carpenter taps experts for their insights and illumination. Topics include cybersecurity, psychology, behavior science, communication, leadership, and more.
Readings from the dark underworld of cybercrime and espionage, recalled to life, reinterpreted, and reimagined for the benefit of the infosec literati. Oh, and it’s also just play and parody from the ever-restless imaginations of the CyberWire editorial team.
C
CyberWire Daily
1
Flagging firmware vulnerabilities. [Research Saturday]
17:54
17:54
Play later
Play later
Lists
Like
Liked
17:54
Roya Gordon from Nozomi Networks sits down with Dave to discuss their research on "Vulnerabilities in BMC Firmware Affect OT/IoT Device Security." Researchers at Nozomi Networks has revealed that there are thirteen vulnerabilities that affect BMCs of Lanner devices based on the American Megatrends (AMI) MegaRAC SP-X. The research states "By abusing…
Roya Gordon from Nozomi Networks sits down with Dave to discuss their research on "Vulnerabilities in BMC Firmware Affect OT/IoT Device Security." Researchers at Nozomi Networks has revealed that there are thirteen vulnerabilities that affect BMCs of Lanner devices based on the American Megatrends (AMI) MegaRAC SP-X. The research states "By abusing…
C
CyberWire Daily
1
An update on the Hive ransomware takedown. More DDoS from Killnet. Advisories from CISA, and an addition to the Known Exploited Vulnerabilties Catalog.
26:50
26:50
Play later
Play later
Lists
Like
Liked
26:50
An update on the takedown of the Hive ransomware gang, plus insights from CrowdStrike’s Adam Meyers. If you say you’re going to unleash the Leopards, expect a noisy call from Killnet. Our guest is ExtraHop CISO Jeff Costlow talking about nation-state attackers in light of ongoing Russian military operations. CISA has released eight ICS advisories, …
C
CyberWire Daily
1
Remote monitoring and management tools abused. Russian and Iranian cyberespionage reported. The world according to the CIO. And if volume is your secret, maybe look for a better secret.
28:42
28:42
Play later
Play later
Lists
Like
Liked
28:42
Joint advisory warns of remote monitoring and management software abuse. Iranian threat actors reported active against a range of targets. UK's NCSC warns of increased risk of Russian and Iranian social engineering attacks. A look at trends, as seen by CIOs. Carole Theriault ponders health versus privacy with former BBC guru Rory Cellan Jones. Kyle…
C
CyberWire Daily
1
CISA Alert AA23-025A – Protecting against malicious use of remote monitoring and management software
2:41
2:41
Play later
Play later
Lists
Like
Liked
2:41
CISA, NSA, and the MS-ISAC are releasing this alert to warn network defenders about malicious use of legitimate remote monitoring and management software. AA23-025A Alert, Technical Details, and Mitigations For a downloadable copy of IOCs, see AA23-025.stix Silent Push uncovers a large trojan operation featuring Amazon, Microsoft, Geek Squad, McAfe…
Nadine Michaelides from Anima People sits down with Dave to discuss preventing insider threat using behavioral science and psych metrics. Joe and Dave share some follow up regarding a Facebook scammer who is targeting Joe, as well as a letter from listener Richard who write in about business emails and the compromised warning signs they send about …
C
Caveat
1
Are there complications with digitizing healthcare?
47:39
47:39
Play later
Play later
Lists
Like
Liked
47:39
This week, the CyberWire's UK Correspondent, Carole Theriault is discussing digitalization of healthcare with former BBC guru Rory Cellan Jones. Ben discusses a recent op-ed about the “danger of privacy at all costs” and response from critics. Dave's story is about the Supreme Court asking the Biden administration for input on social media laws in …
C
CyberWire Daily
1
TA444 and crypto theft on behalf of the Dear Successor. CryptoAPI spoofing vulnerability described. New Python-based malware campaign. User headspace. Tanks vs. hacktivists.
30:40
30:40
Play later
Play later
Lists
Like
Liked
30:40
How do the North Koreans get away with it? They do run their cyber ops like a creepy start-up business. A spoofing vulnerability is discovered in Windows CryptoAPI. Python-based malware is distributed via phishing. MacOS may have a reputation for threat-resistance, but users shouldn't get cocky. DevSecOps survey results show tension between innovat…
C
Control Loop: The OT Cybersecurity Podcast
1
ICS/OT incident response plans: Don't get caught unprepared.
40:18
40:18
Play later
Play later
Lists
Like
Liked
40:18
The NOTAM outage was reportedly caused by a corrupted file. The World Economic forum sees geopolitical instability as a source of cyber risk. The Copper Mountain Mining Corporation is working to recover its IT systems following a ransomware attack. DNV's fleet management software sustains a ransomware attack. Ukrainian hacktivists conducted DDoS at…
C
CyberWire Daily
1
Cyber Marketing Con 2022: From the horse’s mouth: CISO Q&A on solving the cyber marketer’s dilemma. [Special Editions]
1:00:44
1:00:44
Play later
Play later
Lists
Like
Liked
1:00:44
At the 2022 Cyber Marketing Con, the CyberWire presented a CISO Q&A panel session on how to help cyber marketers reach CISOs and other security executives in the industry. The panel included Rick Howard, CSO of N2K Networks, Jaclyn Miller, Head of InfoSec and IT at DispatchHealth, Ted Wagner, CISO of SAP NS2, and was moderated by board director & a…
C
CyberWire Daily
1
Disentangling cybercrime from cyberespionage. A threat to the IoT supply chain. What do you do with the hacktivists when they stop being hacktivists? A retired FBI Special Agent is indicted.
29:47
29:47
Play later
Play later
Lists
Like
Liked
29:47
DragonSpark conducts "opportunistic" cyberattacks in East Asia. ProxyNotShell and OWASSRF exploit chains target Microsoft Exchange servers. The IoT supply chain is threatened by exploitation of Realtek Jungle SDK vulnerability. CISA adds an entry to its Known Exploited Vulnerabilities Catalog. A Cisco study finds organizations see positive returns …
A software program installed unintentionally by a user that typically performs tasks not asked for by the installer. CyberWire Glossary link: https://thecyberwire.com/glossary/potentially-unwanted-program Audio reference link: Butler, S., 2022. Potentially Unwanted Programs (PUPS) EXPLAINED [Video]. YouTube. URL https://www.youtube.com/watch?v=5L42…
A team responsible for responding to and managing cybersecurity incidents involving computer systems and networks in order to minimize the damage and to restore normal operations as quickly as possible. CyberWire Glossary link: https://thecyberwire.com/glossary/cirt Audio reference link: Avery, B., 2017. 24 TV May 05 Season4 [WWW Document]. YouTube…
8
8th Layer Insights
1
Season 3 finale: What's the deal with Authentication, MFA, and Password Managers?
1:12:04
1:12:04
Play later
Play later
Lists
Like
Liked
1:12:04
For the last episode of season 3, I thought we'd talk about something that's been in the news quite a lot recently: Authentication and Password Managers. As security professionals, we've decried the password for decades. Multifactor authentication (MFA) has started to gain popularity... but not without its own issues. Security leaders and tech team…
C
CyberWire Daily
1
Contractor error behind FAA outage. OneNote malspam. Vastflux ad campaign disrupted. Ukraine moves closer to CCDCOE membership. Alerts for gamblers and gamers.
26:31
26:31
Play later
Play later
Lists
Like
Liked
26:31
The FAA attributes its January NOTAM outage. Malicious OneNote attachments are appearing in phishing campaigns. The Vastflux ad campaign has been disrupted. Ukraine moves toward closer cybersecurity collaboration with NATO. Rick Howard considers the best of 2022. Deepen Desai from Zscaler looks at VPN Risk. And, finally, we’re betting you want aler…
C
CSO Perspectives (public)
1
A Rick the Toolman Episode on the current state of SBOMs.
18:19
18:19
Play later
Play later
Lists
Like
Liked
18:19
One way to reduce the risk of software supply chains is with a concept called a Software Bill of Materials (SBOMs). Standards bodies have been slowly working in the background for the past decade to move this concept into reality. On this episode Rick Howard discusses the current state of SBOMs, and throws some Rick the Toolman in as well.…
C
CyberWire Daily
1
Miriam Wugmeister: Technology's not as complicated as you think. [Data Security] [Career Notes]
9:53
9:53
Play later
Play later
Lists
Like
Liked
9:53
Miriam Wugmeister, co-chair of Morrison & Foerster’s Privacy and Data Security practice, sits down to share her in-depth experience and understanding of privacy and data security laws, obligations, and practices across a wide range of industries. She talks about how she grew up not knowing exactly what she wanted to get into as a profession, starti…
C
Career Notes
1
Miriam Wugmeister: Technology's not as complicated as you think. [Data Security]
9:53
9:53
Play later
Play later
Lists
Like
Liked
9:53
Miriam Wugmeister, co-chair of Morrison & Foerster’s Privacy and Data Security practice, sits down to share her in-depth experience and understanding of privacy and data security laws, obligations, and practices across a wide range of industries. She talks about how she grew up not knowing exactly what she wanted to get into as a profession, starti…
C
CyberWire Daily
1
The power of web data in cybersecurity. [CyberWire-X]
28:57
28:57
Play later
Play later
Lists
Like
Liked
28:57
The public web data domain is a fancy way to say that there is a lot of information sitting on websites around the world that is freely available to anybody who has the initiative to collect it and use it for some purpose. When you do that collection, intelligence groups typically refer to it as open source intelligence, or OSINT. Intelligence grou…
C
CyberWire Daily
1
Billbug infests government agencies. [Research Saturday]
16:03
16:03
Play later
Play later
Lists
Like
Liked
16:03
Brigid O. Gorman from Symantec's Threat Hunter Team joins Dave to discuss their report "Billbug - State-sponsored Actor Targets Cert Authority and Government Agencies in Multiple Asian Countries." The team has discovered that state-sponsored actors compromised a digital certificate authority in an Asian country during a campaign in which multiple g…
Brigid O. Gorman from Symantec's Threat Hunter Team joins Dave to discuss their report "Billbug - State-sponsored Actor Targets Cert Authority and Government Agencies in Multiple Asian Countries." The team has discovered that state-sponsored actors compromised a digital certificate authority in an Asian country during a campaign in which multiple g…
C
CyberWire Daily
1
Ransomware in Costa Rica. Cyberespionage against unpatched FortiOS instances. Credential stuffing PayPal, breaching T-Mobile. Utility business systems hit. Hackathons and phishing in Russia.
29:04
29:04
Play later
Play later
Lists
Like
Liked
29:04
Ransomware hits Costa Rican government systems, again. A Chinese threat actor deploys the BOLDMOVE backdoor against unpatched FortiOS. Credential stuffing afflicts PayPal users. T-Mobile discloses a data breach. A cyberattack hits a remote Canadian utility. The Wagner Group sponsors a hackathon. Malek Ben Salem from Accenture describes prompt injec…
C
CyberWire Daily
1
Criminal-on-criminal action in the dark web. The cyber phases of the hybrid war heat up. ICS vulnerabilities. Codespaces and malware servers. Blank-image attacks. Social engineering.
29:12
29:12
Play later
Play later
Lists
Like
Liked
29:12
A hostile takeover of the Solaris contraband market. Ukraine warns that Russian cyberattacks continue. An overview of 2H 2022 ICS vulnerabilities. Codespaces accounts can act as malware servers. Blank-image attacks. Campaigns leveraging HR policy themes. Dinah Davis from Arctic Wolf has tips for pros for security at home. Our guest is Gerry Gebel f…
