Martin, Martin, and Rich close out 2011 with huge thank you's to our listeners and with some exciting things coming up in 2012.

Thanks so much to all of you who help make this podcast so much fun!

The guys are all together to talk about the Upbeat and Downbeat infosec stories of 2011 as well as provide prognostications for what is to come in 2012.

Oh - and we create some instant memes featuring Wilfred Brimley and the crazy guy from Ancient Aliens.

See www.southernfriedsecurity.com for full show notes and links!

Not the normal episode...  This time we feature a great interview with Bob Rudis (@hrbrmstr) where we discuss information security and risk analysis....oh, and why French-Vietnamese fusion cuisine might be a good business investment..

Andy, Steve, and Joseph enjoy a week of recording with Martin around...but that'll come back to bite'em.

Episode 63 - We Welcome Our Alien Overlords

Well, it was too good to be true, we didn't have the whole crew

together, but Martin, Andy, and Joseph hit a couple of topics tonight

anyway:

First was the continuing story of the virus that has hit the U.S.

drone fleet. We also posit the theory that the virus was put there by

aliens. Just saying.

http://arstechnica.com/business/news/2011/10/exclusive-computer-virus-hits-drone-fleet.ars

Then, two articles that we kind of rolled together, discussing first

the role of compliance in a company's outside contractors:

http://www.darkreading.com/compliance/167901112/security/news/231900432/compliance-outside-corporate-walls.html

Then we discussed the article from George Hulme and Eric Cowperthwaite

talking about budget and the role of the CSO.

http://www.csoonline.com/article/691048/hey-csos-suck-it-up-and-accept-budget-cuts

And don't forget, BSidesDFW and BSidesATL are coming up quick! If

you're in the area of either, don't forget to sign up!

Episode 62 - Leaders & Experts

This week, for two weeks in a row, the whole gang is back. We hit two

articles that provoked a lot of thought amongst us, so without further

ado:

Security 101: Security in 140 Characters or Less

http://isc.sans.edu/diary.html?storyid=11725&rss

Are you an IT security leader - really?

http://www.networkworld.com/news/2011/100311-are-you-an-it-security-251503.htm

Join us next week, as we continue to put right what once went wrong,

and hope each time that our next leap will be the leap home.

All four of the boys are together after an unplanned hiatus where Andy was on vacation, Steve went on Covert Ops to Romania, Joseph had to get a restraining order for those pesky girls, and Martin had to deal with the magic smoke leaving most of his podcasting gear.

The boys talk about whether SIEM is dead or not (hint: it doesn't want to get on the cart!) and about DigiNotar.

See y'all next episode!

This evening, it was just Martin and Joseph covering some of the big
news of the past week: Diginotar and Sony.

Signal to Noise

Diginotar, a Certificate Authority from Holland was breached over this
past week, and the fallout just seems to keep growing:

http://www.thetechherald.com/article.php/201136/7580/DigiNotar-security-incident-goes-from-bad-to-worse?utm_source=twitterfeed&utm_medium=twitter
http://www.f-secure.com/weblog/archives/00002231.html

Back in the spotlight again is Sony, but for good (we hope) reasons
this time, as they've announced their new CISO:
http://www.1up.com/news/sony-hires-dhs-official-chief-information-security-officer

Also, as we said on the podcast, for people with a high signal to
noise ratio on Twitter, try starting with these folks.

@CSOonline @mikkohypponen @uscert_gov @HDMoore @rwestervelt @WeldPond
@riskybusiness

The full crew is here tonight as we discuss a little news and have an interesting talk with Josh Corman about his recent talk at DefCon.  Full show notes can be found at http://www.southernfriedsecurity.com.

Martin, Andy, and the Web Lackey get together to talk briefly about BlackHat/DefCon/BsidesLV and the "big news" put out by Mcafee on "Shady RAT".

We also share a super interview done with Andy Ellis (@csoandy) on building teams and the hiring process.

Rich Mogull of Securosis and the Network Security Podcast graciously spoke with Martin a while back.  They talked about how security leaders should evaluate and select technologies and had some great ideas on effective vendor management.

But before you get to hear that take a listen to Joseph, Steve, and Martin discuss the one item of interest that really picqued their interest...

Have fun in Vegas!

Just Martin and Joseph this evening, as our other hosts are otherwise engaged. Unlike Joseph, who is now married, instead of engaged.

Jumping right in, we decided to stick with what we know, and talked about Dark Reading's article on how the recent breaches have led to a recent rash of hirings in the InfoSec field, from the CSO level all the way down to the junior analyst level.

http://www.darkreading.com/security-monitoring/167901086/security/attacks-breaches/231000315/high-profile-hacks-prompt-high-powered-hires.html

And with the recent demise of LulzSec, it's now time to begin an analysis of the effects of the events perpetrated from the LulzBoat. Our good friend Bill Brenner at CSO Online wrote a great article entitled "Whatever, Lulzsec."

http://blogs.csoonline.com/1570/whatever_lulzsec

We wrapped up with the story that brought the title to this episode, we discussed the differences that Symantec has found between iOS devices and Android equipped phones.

http://www.csoonline.com/article/print/685253

That's it for this evening, but we'll see you again next week!

Martin, Andy, and Steve finally manage to get schedules set and talk.  Unfortunately Joseph can't come out to play this week so the old guys have the mike.  Quick note and apologies about some of the audio quality - we're working to fix it.

Join Martin and Steve as they discuss a quite unbelieveable blog post from LogLogic (http://www.loglogic.com/blog/what-does-s-stand), the continuation of "Breach-A-Week", and Martin's recent visit to Vegas for HP Discover 2011.

Unfortunately Andy and the News Yankee couldn't make it so Martin and Joseph sit back and discuss the upcoming Job Hunting Season that seems to exist for a couple of months on either side of DEFCON/BlackHat and how both job seekers and those wanting to fill seats can have the best success...

Martin, Andy, and Steve get together to talk about the recent breaches of the Sony Playstation Network.  They discuss various aspects of what happened, how Sony has been handling it, and Andy gives a very kind grade to their communications strategy to date.

The guys are joined by Rafal Los where we discuss application security, especially around mobile devices, and how some people (meaning Martin) think the return of the GreenScreen GUI might not be a bad thing.

Steve can't make it tonight so Martin, Andy, and Joseph sit down with James Arlen (@myrcurial) to discuss items of interest...

Like the general insanity of the infosec echo chamber when it comes to Amazon EC2 outages, DropBox TOS updates, and Applie iPhone location information...

Oh, and we talk about Doing Infosec Right.  It's a new project designed to bring good information from people who do defensive security to people who are trying to do defensive security.  You can find more at http://www.doinginfosecright.com.

Join Martin, Steve, and Joseph as they discuss the Verizon Data Breach Incident Report with special guest Josh Corman.

And remember to check out Charlotte ISSA at http://www.charlottaissa.org to register for their conference on May 5th!

Just Andy and Joseph this week, but we hit some fairly hefty topics, particularly the breaches that seem to keep springing up every day lately.

First, Derek Newton has discovered a very interesting flaw in Dropbox's host authentication.
http://dereknewton.com/2011/04/dropbox-authentication-static-host-ids/

Then, we discussed the breaches of the week: Barracuda, Hartford, and US Airways.
http://www.theregister.co.uk/2011/04/11/barracuda_networks_attack/
https://www.threatpost.com/en_us/blogs/hartford-hacked-040711
https://www.threatpost.com/en_us/blogs/insider-allegedly-leaked-data-belonging-3000-us-airways-pilots-041111

And in the "too close to home for comfort" category, we finished up with the Texas Comptroller breach:

http://www.statesman.com/blogs/content/shared-gen/blogs/austin/politics/entries/2011/04/11/comptroller_personal_id_inform.html
http://blogs.chron.com/texaspolitics/archives/2011/04/personal_inform.html

As always, you can find the podcast here: http://sfspodcast.libsyn.com/rss

And if you have any feedback, drop us a comment or find us at @SFSPodcast on twitter.

We're joined by our newest team member - Zach Lanier!

The crew discusses the recent events at RSA in the context of "What Should A CISO DO?"

Here are some of the stories we found...

Calm

http://www.govinfosecurity.com/podcasts.php?podcastID=1050
http://www.scmagazineuk.com/the-impact-of-the-rsa-token-data-breach-is-still
-undetermined/article/198935/

Panic

http://www.channelregister.co.uk/2011/03/24/rsa_securid_news_blackout/
http://blogs.computerworlduk.com/jericho-forum/2011/03/after-the-breach---ho
w-secure-is-rsas-securid/
http://www.americanbanker.com/bulletins/-1034737-1.html

FUD

http://www.digitalidnews.com/2011/03/23/ironkey-protects-banks-and-their-cus
tomers-from-rsa-securid-data-breach
(alt)
http://www.istockanalyst.com/business/news/4990527/ironkey-introduces-protec
tion-for-banks-and-their-customers-from-rsa-securid-data-breach
http://www.networkworld.com/news/2011/032311-rsa-securid-backdoor.html?page=
1
http://www.businesswire.com/news/home/20110322006389/en/Swivel-Secure-Authen
tication-Expert-Comments-RSA-Security
http://www.microscope.co.uk/news/rivals-move-to-plug-gap-left-by-rsa-uncerta
inty/

We'll be back next time with more fun and stories!

Well, the boys are short the News Yankee this week...

Joseph is back from South By Southwest and BSides Austin and gives a brief rundown on the doings there.

Martin interviews Larry Ponemon about the "Cost of Compliance" study recently published by the Ponemon Institute.

Andy?  He's just hanging out with the infant.

Again, we're sorry that Andy moving to Google mail caused the outage.  We promise to provide more warning when Andy finally breaks down and buys an iPad...

This week the guys discuss....

Is Stress Making You Want To Crack?

http://www.darkreading.com/security-monitoring/167901086/security/security-management/229219084/under-growing-pressure-security-pros-may-be-ready-to-crack-study-says.html

HIPAA penalties finally hit the big time...

http://www.csoonline.com/article/669067/hipaa-privacy-actions-seen-as-warning

Couple of Google stories...  First, a small percentage but large number of users get their gmail accounts reset...

https://www.infosecisland.com/blogview/12162-Gmail-Data-Vanishes-Into-the-Cloud.html

And Google introduces 2-Factor Authentication for gmail....

http://www.darkreading.com/authentication/167901072/security/client-security/229218478/google-introduces-two-factor-authentication-option.html

Episode 44 - Lessons in DR: The Good, the Bad and the News Yankee

This episode, our good friend and host, Martin Fisher was unable to join us, so it was just Andy, Steve, and 
Joseph. And without Martin's guiding hand, the other boys allowed the News Yankee an uprecedented amount 
of microphone time, as Steve discussed his trip and the many lessons he learned at RSA this year. 

You can check out some of Steve's write-ups at these links:

   http://www.thetechherald.com/article.php/201108/6841/RSAC-2011-Forming-a-bridge-between-law-enforcement-and-security

   http://www.thetechherald.com/article.php/201108/6845/RSAC-2011-Lost-assets-and-incident-response-learn-from-my-fail

We then wrapped up with a discussion of Data Recovery, and making sure you fully test your plans, with this lovely example provided to us by FEMA:

   http://www.govinfosecurity.com/articles.php?art_id=3339

That's all we had time for this week! 

As always, you can find the podcast here: http://sfspodcast.libsyn.com/rss

And if you have any feedback, drop us a comment or find us at @SFSPodcast on twitter.

Martin and Joseph have a really good discussion with Paul Asadoorian and John Strand of Pauldotcom Security Weekly fame to discuss ideas around Offensive Security in light of some segments from their podcast and recent events involving HBGary.

Full show notes with links can be found at http://www.southernfriedsecurity.com

Enjoy!

Martin, Andy, Steve, and Joseph discuss a new study released by Ponemon and reflect on lessons that can be learned already from the HBGary incident with Anonymous.

Join us as we feature Lee Kushner of LJ Kushner Associates in an interview about careers, career planning, and special surprises coming at this years RSA Conference.

Episode 40 – Breathe In, Breathe Out…

1. Introductions

2. We were nominated for AShimmy’s Best Security Podcast of 2010! If you’re a blogger, we’d love your vote! http://www.ashimmy.com/2011/01/and-the-winners-are.html

3. We discuss the incredibly insightful and masterfully created ISC2 “12 Principles of Information Security” https://www.isc2.org/PressReleaseDetails.aspx?id=7012

4. Martin and Andy interview the illustrious Mike Dahn (http://twitter.com/mikd or http://chaordicmind.com/blog/)

5. Closeout.

Download the show here, or find us on iTunes!:

http://sfspodcast.libsyn.com/rss

Join Martin, Andy, Steve, and Joseph as they discuss the right way to use Fear, Uncertainty, and Doubt to sell your information security program and as they reveal the topics and conferences every infosec professional needs to be familiar with for 2011.