Hey all! I'm at BlackHat and Defcon this week. If you're there, track me down. I'd love to meet you! This week's episode is an encore of one of my favorites. My interview with James Linton (a.k.a. The Email Prankster). In 2017, James went on a virtual joyride exploiting the ways that people interact with emails. One of the most interesting things about James' story is that his exploits didn't rely on any type of highly technical method(s); they were simple display name deceptions. But that didn'...
Aug 08, 2023•1 hr 7 min
There has been a lot of buzz for the past few years about the benefits and importance of establishing security champions programs. These are groups of people in your organization who become vital, responsible, and proactive contributing evangelists to the security culture of your organization. I often refer to them as "culture carriers." And, while there is general agreement that these are good programs to have, establishing them is currently a bit of a dark art. On today's show, Perry sits down...
Jul 26, 2023•45 min•Season 4Ep. 5
On this episode, Perry sits down with Chad Peterson, Managing Director at NetSPI, to discuss the importance of penetration testing. We touch on aspects of social engineering, discussing complex security issues with Boards of Directors, the prevalence of Ransomware, and some of the unique challenges facing the healthcare industry. Guest: Chad Peterson (LinkedIn) (Twitter) Books & References (Books are Amazon Associate links) CISO Desk Reference Guide: A Practical Guide for CISOs by Bill Bonney, G...
Jun 20, 2023•47 min•Season 4Ep. 4
On this episode, what cybersecurity professionals need to understand about how social signaling and incentives really work. Today's episode features a conversation with Uri Gneezy. In the field of cybersecurity, we are very interested in identifying proactive and positive ways to encourage the behavior we want. That's where Uri comes in. Uri is a well-known behavioral economist and professor of economics and strategy in the Rady School of Management at the University of California at San Diego. ...
Jun 06, 2023•48 min•Season 4Ep. 3
In this episode, Perry Carpenter sits down with renowned mentalist and skeptic, Banachek. Banachek (Steve Shaw) grew up with a fascination in magic and a frustration with psychic frauds. As a teenager, he contacted magician and skeptic, James “The Amazing” Randi and ended up working with Randi on a special initiative known as Project Alpha, which set out to expose a general lack of objectivity in parapsychology research. Banachek served as the director for the James Randi Educational Foundation’...
May 23, 2023•1 hr 13 min
This week's episode is a late Star Wars ("May the 4th Be With You") celebration. We check out a couple interesting articles about security-related lessons embedded in the Star Wars movies, and Perry sits down with Adam Shostack, author of the new book, Threats: What Every Engineer Should Learn From Star Wars to discuss threat modeling principles using Star Wars related examples. Guest: Adam Shostack (LinkedIn) (Twitter) (Website) Books & References (Books are Amazon Associate links) Threats: Wha...
May 09, 2023•50 min•Season 4Ep. 2
Welcome to season 4, episode 1 of 8th Layer Insights! On this episode, Perry speaks with Josiah Dykstra (Senior Fellow, Office of Innovation at the National Security Agency) about the new book he co-authored with Eugene Spafford and Leigh Metcalf. The book is titled Cybersecurity Myths and Misconceptions: Avoiding the Hazards and Pitfalls that Derail Us, This topic coincides well with Perry's recent studies into folklore and urban legends for his other podcast, Digital Folklore. Guests: Josiah D...
Apr 25, 2023•48 min•Season 4Ep. 1
For the last episode of season 3, I thought we'd talk about something that's been in the news quite a lot recently: Authentication and Password Managers. As security professionals, we've decried the password for decades. Multifactor authentication (MFA) has started to gain popularity... but not without its own issues. Security leaders and tech teams may have once again hoped for a silver bullet, only to be disappointed to find out that crafty attackers can easily bypass MFA. We've also been tout...
Jan 24, 2023•1 hr 12 min•Season 3Ep. 10
Hey all! An announcement and something special! First, the announcement: Here's your chance to participate in the final episode of 8Li season 3. If you’ve got a question or comment that you’d like me to try to answer or respond to, leave a voice message at https://www.speakpipe.com/8Li. Frankly, that would make it more engaging than if I just read your questions. But, if you aren’t able to record a message or don’t want your voice on the show, then you can email me your questions at perry@8thLay...
Jan 10, 2023•14 min
On this episode, Perry speaks with Chris Cochran and Ron Eddings. Chris and Ron started the Hacker Valley Studio Podcast back in June of 2019 with the goal of exploring the human condition to inspire peak performance in cybersecurity. The podcast is about Chris and Ron’s quest to find inspirational stories and knowledge to elevate themselves and their communities. That podcast eventually kicked off a journey that led them to create their own podcast network (Hacker Valley Media), foster communit...
Dec 27, 2022•47 min•Season 3Ep. 9
On this episode, Perry sits down with Marta L. Tellado, President and CEO at Consumer Reports, to discuss the digital moment we are in and what that means for consumers and the marketplace: the risks, dangers, traps… and also the places and paths that can lead to progress. They also discuss Marta's new book, Buyer Aware: Harnessing Our Consumer Power for a Safe, Fair, and Transparent Marketplace. Guest: Marta L. Tellado (LinkedIn) (Twitter) (Website) Books and References: Fighting For a Fair Dig...
Dec 13, 2022•51 min•Season 2Ep. 8
Get ready for those 'fun' holiday dinner conversations with friends and family. You know the ones... In the spirit of the holidays, I thought we'd revisit Season 1, Episode 2. This is an episode about the battle for truth. As disinformation, misinformation, malinformation, and conspiracy theories seem to be hitting epidemic levels, how can we help each other determine what is real and what is fake? How can we help people who are falling down conspiracy rabbit holes? And what roles do technology ...
Nov 29, 2022•1 hr 5 min
There is something about a good spy story that seems to really resonate with people in the cybersecurity world. We love watching the moves and the counter moves, and the sneaking around, and the social engineering, and hacking, and all of the gadgets and toys, and car chases, and fights and double crosses and triple crosses. Yeah, you get the point. But how much of that is real and how much can be chalked up to an author's creative license? And what's life and work like for real people in the in...
Nov 15, 2022•52 min•Season 3Ep. 7
For this week, we are revisiting a previous episode that first aired as Season 1 Episode 10. In this episode, we discuss the concept of security culture -- specifically, the difficulty that security leaders have in defining what a security culture actually is. Luckily, we can draw on learnings from organizational culture management and culture transformation experts. Guests for this episode include, David Sturt, Executive Vice President of the O.C. Tanner Institute, author of Great Work: How to ...
Nov 01, 2022•1 hr 10 min
On this episode, Perry sits down with Jenny Radcliffe (a.k.a. The People Hacker). Jenny is a well-known speaker, podcaster, professional social engineer, and physical penetration tester… in other words, she’s a social engineer who specializes not only in tricking people into doing things they shouldn’t do… but she also specializes getting into places she shouldn’t be and finding things she shouldn’t be able to find. Her job is to embody the criminal mindset and use the skills of a criminal to fi...
Oct 18, 2022•36 min•Season 3Ep. 6
Over the past few years, there's been a lot of talk about the value of understanding Open Source Intelligence (OSINT). But, even with so much talk, relatively few cybersecurity professionals have had the time to take a deep dive into the topic. In this episode, Perry sits down with social engineer, OSINT investigator, and member of the OSINT Curious project, Christina Lekati to get an overview of the value of OSINT as well as some basic techniques. After that, we hear from Chris Kirsch (co-found...
Oct 04, 2022•47 min•Season 3Ep. 5
In this episode, Perry talks about the value of storytelling and provides 7 tips for anyone who faces the fear associated with staring at a blank screen, wondering how they can begin to create fresh content. This is adapted from a presentation Perry recently gave at the 2022 SANS Security Awareness Summit. Books & Resources: Overview of "The Iron Triangle" Visual Summary of Perry's SANS Security Awareness Summit presentation YouTube Video: You are not a storyteller - Stefan Sagmeister @ FITC Sec...
Sep 20, 2022•45 min•Season 3Ep. 4
In this episode, Perry sits down with Mikko Hyppönen for a wide ranging discussion about the history, current state, and future of cybersecurity. We also discuss Mikko's new book, the title of which is derived from Hyppönen's Law: If It's Smart, It's Vulnerable. Guest: Mikko Hyppönen (LinkedIn) (Twitter) (Web) Books & Resources: If It's Smart, It's Vulnerable, by Mikko Hyppönen Mikko's TED Talks Daemon, by Daniel Suarez Internet of Things and data placement, by Dell Technologies Transformational...
Sep 06, 2022•49 min•Season 3Ep. 3
This is a follow-up to Season 2, episode 4 –Bridging the Cyber Skills Gap. Many listeners contacted me saying that they loved the episode, but wished that I’d put more focus on people trying to find a career in cybersecurity later in life. So, consider this episode a Bridging the Cyber Skills Gap Part 2. We’ll hear the stories of several people who’ve come to cybersecurity a bit later in life. This episode features interviews with Alethe Denis, Tracy Z. Maleeff (a.k.a. InfoSec Sherpa), Phillip W...
Aug 23, 2022•46 min•Season 3Ep. 2
You've probably been hearing the term 'mindfulness' a lot these days. And for good reason. We humans seem to be busier and more stressed out than ever before, and mindfulness practices seem to offer positive benefit. But how does mindfulness intersect with cybersecurity? What practices can we learn and promote to decrease human risk in our organizations and live safer digital lives? In this episode, we explore the topic of cyber mindfulness. And to do so, we'll be hearing from Anna Collard, Mich...
Aug 09, 2022•47 min•Season 3Ep. 1
On this bonus episode, Perry sits down with physical penetration tester, lock picking guru, and Board Member of The Open Organization of Lockpickers (TOOOL), Deviant Ollam. They discuss lockpicking, physical penetration testing, locksport, and the ethics of teaching these skills. Guest: Deviant Ollam (Twitter) (YouTube) (Website) Books & Resources: 8th Layer Insights S2E8: Fun and Games: Lock Picking, Capture the Flag Contests, Simulations, and More Lockpicking Resources from Deviant Ollam Keys ...
Jun 22, 2022•27 min
On this bonus episode, Perry sits down with investigative journalist, speaker, podcaster, and author, Geoff White to talk about his path into investigative journalism, podcasting, and his new book, "The Lazarus Heist: From Hollywood to High Finance: Inside North Korea's Global Cyber War." Guest: Geoff White (LinkedIn) (Twitter) (Website) Books & Podcasts: Lazarus Heist Book Lazarus Heist Podcast Crime Dot Com: From Viruses to Vote Rigging, How Hacking Went Global Transformational Security Awaren...
Jun 07, 2022•45 min
Please take the listener survey--->>> https://www.surveymonkey.com/r/8LI_Survey...
May 17, 2022•5 min
If you could interview a password, what questions would you ask? Today, May 5th, 2022 is World Password Day. World Password Day was first established in 2013 and is celebrated each year on the 1st Thursday in May. To celebrate, I thought it would be fun to share an excerpt of a previous episode ("Security is Alive") where I interviewed multiple security-related objects. This clip is my interview with Dave the Password. Stick around after the interview for a few password-related tips and best pra...
May 05, 2022•13 min
Creativity can be a scary topic for technologists. Most of us haven't been trained in the art and science of creativity and so they either feel out of their depth when called on to create content. But it doesn't have to be that way. In this episode, Perry sits down with New York Times bestselling author, Michelle Richmond, Audible bestselling author Rob Dircks, and two critically acclaimed cybersecurity podcasters, Ran Levi (creator and host of the Malicious Life podcast) and David Spark (creato...
May 03, 2022•1 hr 13 min•Season 2Ep. 10
"Security Awareness" is a slippery topic for a lot of people. It's a well known phrase -- and, let's face it, it's a phrase that can be very misleading. In this episode, Perry sits down with Dr. Jessica Barker (author and co-CEO at Cygenta), Cassie Clark (Security Awareness Lead Engineer at Brex), John Scott (Head of Security Education at Bank of England), and Lance Spitzner (Director, SANS Institute: Founder, Honeynet Project) to discuss what is currently being done well and, more importantly, ...
Apr 19, 2022•50 min•Season 2Ep. 9
Risk is a funny thing – our minds are constantly looking for risk, scanning our environments and our available choices. And sometimes we do a great job at anticipating and avoiding risky situations. But that doesn’t mean that we are universally good at dealing with risk. In fact, we can be downright appalling at considering and avoiding risk. In this episode, we explore the concept of risk, why we're so bad at understanding it, and the steps we can take to improve. Perry speaks with four risk ex...
Apr 04, 2022•54 min
What images come to mind when you see or hear the word 'Cybersecurity?' That word probably evokes mental images of people hunched over keyboards launching cyberattacks at each other. Or maybe you picture someone picking a lock or stealing a badge to slip into a building. In other words, most people picture the battle... or what some might think of as "the fun parts." But, here's the thing. Not everyone gets to participate in these aspects of cybersecurity and, in many cases, finding safe and leg...
Mar 22, 2022•1 hr 2 min•Season 2Ep. 8
If you love learning about cons, scams, and tricks, then this is the episode for you. Listen as Perry sits down with Brian Brushwood, someone who has made understanding and teaching scams and tricks his life's work. Brian is the creator of Scam School, Scam Nation, Hacking the System, Modern Rogue, and more. For the past 20 years, he's toured around the world teaching and demonstrating everything from side show stunts, to sleight-of-hand magic, to the intricacies of con artistry. Brian’s new pod...
Mar 08, 2022•1 hr 7 min•Season 2Ep. 7
Every now and then you need to try something new. That's what this episode is. If you listened to Season 2, Episode 3 (Technology and the Law of Unintended Consequences), you may remember the mock interview with Janet, the virtual assistant. This episode expands that idea and features a set of four mock interviews -- all with security-related object. This is an interesting experiment to help flesh-out some ideas behind these objects, the reasons they exist, their motivations, and the situations ...
Feb 22, 2022•49 min•Season 2Ep. 6
