From Paul's Security Weekly
Recorded June 10, 2019 at G-Unit Studios in Rhode Island!
- We have exciting news about the Security Weekly webcast program: We are now partnered with (ISC)2 as an official CPE provider! If you attend any of our webcasts, you will be receiving 1 CPE credit per webcast! Register for one of our upcoming webcasts with ExtraHop, SaltStack, and CoreSecurity by going to securityweekly.com/webcasts If you have missed any of our previously recorded webcasts, you can find our on-demand library at securityweekly.com/ondemand
- So many of the big East Coast cybersecurity tradeshows take place in crowded cities like Boston and New York, where parking is a nightmare and will cost you an arm and a leg. However, this year's Compass Cybersecurity Symposium is being held at Twin River Casino in Lincoln, RI, just 15 minutes outside of Providence! The venue has plenty of free and easy parking. Speakers include social engineering expert Chris Hadnagy and Security Weekly podcast founder Paul Asadoorian. Use the discount code "SW2019" to save $20 on registration!
- Security Weekly will be at Hacker Halted in Atlanta, GA this October 10th-11th! EC-Council is offering our listeners a $100 discount to attend the two day conference. Use discount code HH19SW when you register or go to securityweekly.com/hackerhalted and register there! Make sure you checkout the keynote (Paul Asadoorian) and Mr. Jeff Man's talk as well!
- We need your help in a survey we are running for research purposes for an upcoming webcast. How mature is your process automation for your various security capabilities? Please visit securityweekly.com/fivestagesofautomationmaturity to submit your responses to our 5 Stages of Automation Maturity Survey! We'll share the results in a webcast in November!
Interview: Tanya Janca, Microsoft
Topic: DevSecOps and Securing Software Supply Chains
Bugs, Breaches, and More!
- "Waiting for the worms to come." -- Pink Floyd and RDP's CVE-2019-0708. Even the NSA warns about the population of exposed systems.
- A patch commands attention for mail servers
- Lookout finds a massive out-of-app adware
- NFC shows a capacity for attack against nearby Android devices
If you build it, they will come
- In macOS Catalina and iOS 13, Apples finds a way to find devices and not lose privacy
- iOS App Transport Security has strong benefits, but weak adoption
Learning & Tools
Food for Thought
- There’s a significant disconnect between DevOps capabilities and DevSecOps readiness
- Two misconfigurations and bug take down Google services, whose postmortem follows principles they extol