Security Weekly Podcast Network (Audio)

In this segment, we will explore some pretty awesome tools for scanning the Internet, with a focus on network edge devices. We'll bring it all together with Claude Code and look at some sample results. Tools include:

• Shodan | Passive recon — query existing scan data for exposed devices, services, and vulns | Passive (API) | Instant (no packets sent)
• ZMap | Host discovery — find live hosts with open ports | L4 (TCP SYN, UDP, IC...

With Q-day getting closer, regulatory guidance pushing firms to migrate to quantum security in the next five years, and an extensive remediation backlog waiting to be discovered, security leaders must start their quantum security migration today. Easier said than done. In this Say Easy, Do Hard segment, we discuss the quantum-safe journey using a framework for crypto-agility.

In part 1, we define cryptographic agility, or crypto-ag...

So much of appsec’s efforts can be consumed by vuln management and a race to patch security flaws. But that’s more a symptom of the ease of scanning and the volume of CVEs. Erik Nost walks through the principles behind proactive security, why the concept sounds familiar to secure by design, and why organizations still struggle with creating effective practices for visibility.

Resources

• https://www.forrester.com/blogs/proactiv...

Interview with Kara Sprague - The AI Fix for Infrastructure’s Oldest Security Risks.

Critical infrastructure, often built on decades-old systems and legacy code, remains vulnerable to cyberattacks. From pipelines and energy grids to transportation networks, we break down where critical infrastructure is vulnerable and how AI could potentially help strengthen defenses.

Interview with Mike Privette - The State of the Cyb...

In this episode, we sit down with the Radare community leader, Pancake, the creator of the Radare2 reverse engineering framework. Whether you’ve never heard of Radare, already use it daily, or are thinking about contributing to its development, this conversation will demystify what makes Radare unique, why thousands of engineers rely on it, and how you can step into the community.

This segment is sponsored by NowSecure. Discover ho...

Security metrics often fail because they measure activity rather than actual risk, often failing to connect with business impact, making them difficult to explain to boards and executives. How do you build efffective metrics that are actionable, contextual, and valuable?

Ben Wilcox, CTO & CISO at ProArch, joins Business Security Weekly to help us speak the language of the board. Ben will cover how to develop measurable, strategic, ...

What happens when secure coding guidance goes stale? What happens LLMs write code from scratch? Mark Curphy walks us through his experience updating documentation for writing secure code in Go and recreating one of his own startups.

One of the themes of this conversation is how important documentation is, whether it's intended for humans or for prompts to LLMs. Importantly, LLMs don't innovate on their own -- they rely on the data ...

Interview with Jeremy Snyder from FireTail about AI Governance

Death by a thousand cuts: the AI shadow IT problem

I think the best description of the AI governance problem during this interview was the title of the award-winning movie, Everything, Everywhere, All At Once. Generative AI has been disrupting businesses, products, and vendor risk management for a few years now. FireTail is one of the companies trying to addres...

This episode is all about trust getting abused at scale.

We start with Chinese-nexus operators pivoting fast onto Qatar using conflict lures and familiar tradecraft.

Then we hit banking, because they deserve it: Lloyds, Halifax, and Bank of Scotland customers seeing other people’s transactions in-app, a straight confidentiality failure, not “someone hacked my phone”.

From there it’s the Middle East conflict exposing what “cloud res...

In the security news this week:

• The XZ backdoor documentary
• Zero days - the clock isn't ticking
• Vulnerability Mis-Management
• Reversing traffic light controllers
• Reversing with Claude
• Don't curl to bash!
• Reading CVEs makes my head hurt
• Dumping browser secrets
• I open-sourced a new(ish) tool
• D-LINK exploits
• There is no password
• I control the building
• When old vulnerabilities become new
• Tile is for stalkers
• Hacking AI
• Iran War: Wh...

AI has created a dilemma for security teams. Attackers are using AI to develop exploits to newly disclosed vulnerabilities faster than security teams can patch them. Security teams have not fully leveraged the capabilities of AI to autonomously prevent these attacks. Without a radical change in approach, organizations will be exposed to an exponentially increasing attack surface. How long can your organization tolerate being exploi...

Medical devices are a special segment of the IoT world where availability and patient safety are paramount. Tamil Mathi explains why many devices need to fail open -- the opposite of what traditional appsec approaches might initially think -- and what makes threat modeling these devices interesting and unique. He also covers how to get started in this space, from where to learn hardware hacking basics to reviewing firmware and movi...

Interview with Anna Pham

Breaking in with ClickFix: Anatomy of a modern endpoint attack

Cybersecurity company Huntress just published a report on a new ClickFix variant they’ve discovered, which they’ve dubbed CrashFix. This technique was developed by KongTuke to serve as the primary lure within a new custom malicious browser extension also created by the group.

In short, the team observed the threat actors using KongTuke’...

In the security news this week:

• Remembering "FX"
• Finding and analyzing Windows drivers
• Network monitoring with Gibson
• the backdoor in your PAM
• The edge is fraying - and attackers have the advantage
• Age verification for Linux?
• Banning AI
• TPMS tracking
• BLE tracking
• weird strings
• Airsnitch
• RESURGE in and on Ivanti
• Attackers using Claude
• Government iPhone hacking kits
• Cisco SD-WAN, Linux, and 2023
• Leakbase leaks
• and Bro, upgrade y...