Software Assurance Maturity Model (SAMM) (noun) [Word Notes]
A prescriptive open source software security maturity model designed to guide strategies tailored to an organization’s specific risks.
Apr 05, 2022•6 min•Season 2Ep. 92
Hacking Humans
Deception, influence, and social engineering in the world of cyber crime.
Last refreshed:
Podcasts are better in Metacast mobile app
Don't just listen to podcasts. Learn from them with transcripts, summaries, and chapters for every episode. Skim, search, and bookmark insights. Learn more
Episodes
Robocall scams and the psychology surrounding them.
Alex Quilici, Robocall Scam Expert of YouMail, discusses how unwanted robocalls are becoming more targeted and the psychology behind some of the worst calls, Joe and Dave share some listener follow up, Joe's story comes from listener Derek who shares how his aunt avoided a scam which wasn't very obvious at first, and Dave's story is about how the FBI released its annual Internet Crime Complaint Center Internet Crime Report for 2021, our catch of the day comes from listener John who shares how he...
Mar 31, 2022•43 min•Season 4Ep. 190
Universal 2nd Factor (U2F) [Word Notes]
An open standard for hardware authentication tokens that use the universal serial bus, or USB, near-field communications, or NFCs, or Bluetooth to communicate one factor in a two-factor authentication exchange.
Mar 29, 2022•7 min•Season 2Ep. 91
Cons: the short one and the first one. [Hacking Humans Goes to the Movies]
Thanks for joining us for the latest episode of our fun project brought to you by the team of Hacking Humans, the CyberWire's social engineering podcast. Co-hosts Dave Bittner and Joe Carrigan are joined by Rick Howard in this series where they view clips from their favorite movies with examples of the social engineering scams and schemes you hear about on Hacking Humans. In this episode, Dave, Joe and Rick are watching Joe's and Rick's scene picks. They watch each of the selected scenes, descri...
Mar 27, 2022•18 min•Season 1Ep. 8
What's behind Buy Now, Pay Later scams?
Jim Ducharme, COO of Outseer joins Dave to discuss buy now pay later scams, Joe and Dave share some listener follow up, Joe has an interesting story about an Unchained Capital partner and how they were hit with a social engineering attack, and Dave's story is on the FIDO alliance, our catch of the day comes from listener Matt, who shares how he won 20.5 million and why he wasn't falling for it. Links to stories: A Big Bet to Kill the Password for Good Unchained Capital partner hit with social en...
Mar 24, 2022•50 min•Season 4Ep. 189
adversary group naming (noun) [Word Notes]
A cyber threat intelligence best practice of assigning arbitrary labels to collections of hacker activity across the intrusion kill chain.
Mar 22, 2022•10 min•Season 2Ep. 90
Data privacy: is it black and white when it comes to your kids?
UK Correspondent Carole Theriault returns talking with guest David Ruiz from Malwarebytes about parents spying on their kids, Joe and Dave share some listener follow up, Joe's shares a story about the top 5 strangest social engineering tactics, Dave's got a story from one of our listeners, Ricky, about best gift card sales practices at retail chains, and our Catch of the Day comes from listener Michael with a well-crafted email full of red flags when you read into it. Links to stories: Rounding ...
Mar 17, 2022•40 min•Season 4Ep. 188
BSIMM (noun) [Word Notes]
A descriptive model that provides a baseline of observed software security initiatives and activities from a collection of volunteer software development shops.
Mar 15, 2022•6 min•Season 2Ep. 89
Technology's effects on students during the pandemic.
Guest Justin Reilly, the CEO of Impero, stops by to talk with Dave Bittner about the mental health of kids in the digital age, Dave's got a story about large-scale phishing campaigns targeting the Indian Electric Vehicle consumers and businesses, Joe's story is from Vade sharing the top 20 most impersonated brands in phishing, and our Catch of the Day comes from Bob, a friend and former coworker of Joe's who received a smishing attempt via text from a "friend" and how he expertly turned the tabl...
Mar 10, 2022•40 min•Season 4Ep. 187
OWASP vulnerable and outdated components (noun) [Word Notes]
Software libraries, frameworks, packages, and other components, and their dependencies (third-party code that each component uses) that have inherent security weaknesses, either through newly discovered vulnerabilities or because newer versions have superseded the deployed version.
Mar 08, 2022•8 min•Season 2Ep. 88
Phishing seems to be cyclical and thematic.
Guest Jeff Nathan, the Director of Threat research at Norton Labs, joins Dave to discuss their most recent Consumer Cyber Safety Pulse Report, Joe and Dave share some follow up from listeners Daniel and Neville who helped the guys with a phrase from a recent Catch of the Day, Joe shares a story about getting around MFA using remote access software, Dave's story is about a jobfishing scam from a fake design firm, and our Catch of the Day is from listener Randy about an unsubscribe email he receiv...
Mar 03, 2022•48 min•Season 4Ep. 186
OWASP software and data integrity failures (noun) [Word Notes]
Code and data repositories that don't protect against unauthorized changes.
Mar 01, 2022•8 min•Season 2Ep. 87
A blurring of lines between nation states and criminals.
Guest Joshua Neil, the Chief Data Scientist for SecurOnix, joins Dave to talk about evasive techniques and identifying nation-state kill chains, Joe shares an update on his identity theft experience, the guys share some follow up from listener Benji who shares experiences of scammers changing the name on gmail accounts at the synagogue where he works saying they are the rabbi and emailing congregants asking for gift cards, Dave's story is about Apple's AirTags and how they led to the discovery o...
Feb 24, 2022•45 min•Season 4Ep. 185
OWASP server-side request forgery (noun) [Word Notes]
An attack technique that leverages an unprotected web server as a proxy for attackers to send commands through to other computers.
Feb 22, 2022•8 min•Season 2Ep. 86
Hustling the hustlers. [Hacking Humans Goes to the Movies]
Thanks for joining us for the latest episode of our fun project brought to you by the team of Hacking Humans, the CyberWire's social engineering podcast. Co-hosts Dave Bittner and Joe Carrigan are joined by Rick Howard in this series where they view clips from their favorite movies with examples of the social engineering scams and schemes you hear about on Hacking Humans. In this episode, Dave, Joe and Rick are watching Joe's and Dave's scene picks. They watch each of the selected scenes, descri...
Feb 20, 2022•21 min•Season 1Ep. 7
Vulnerabilities will be found.
Guest Deral Heiland from Rapid7 talks with our UK Correspondent Carole Theriault about the state of IOT, Joe shares a personal story about bank checks and a debit card received at his home that were in his name but not from his bank, Dave's got a story from an email he received from the PR department at TikTok about romance scams, and our Catch of the Day is from listener John about a friend who was harassed on Facebook to click a link and how John addressed it. Links to stories: #BeCyberSmart: ...
Feb 17, 2022•48 min•Season 4Ep. 184
OWASP security logging and monitoring failures (noun) [Word Notes]
The absence of telemetry that could help network defenders detect and respond to hostile attempts to compromise a system.
Feb 15, 2022•6 min•Season 2Ep. 85
If you wish for peace, prepare for cyberwar.
Guest Nick Shevelyov, Chief Security Officer for Silicon Valley Bank. joins Dave sharing some personal history around security, and discussing his book "Cyber War… and Peace," Dave and Joe have some follow up from an anonymous listener about mobile device management issue at their work, Dave has a story where a woman was scammed out of thousands while someone contacted her to "help" with a problem with their bank, Joe's got a few stories about Facebook and ad scams, and our Catch of the Day is f...
Feb 10, 2022•50 min•Season 4Ep. 183
OWASP identification and authentication failures (noun) [Word Notes]
Ineffectual confirmation of a user's identity or authentication in session management.
Feb 08, 2022•6 min•Season 2Ep. 84
How to talk your way in anywhere. [Hacking Humans Goes to the Movies]
Thanks for joining us for the latest episode of our fun project brought to you by the team of Hacking Humans, the CyberWire's social engineering podcast. Co-hosts Dave Bittner and Joe Carrigan are joined by Rick Howard in this series where they view clips from their favorite movies with examples of the social engineering scams and schemes you hear about on Hacking Humans. In this episode, Dave, Joe and Rick are watching Dave's and Rick's scene picks. They watch each of the selected scenes, descr...
Feb 06, 2022•22 min•Season 1Ep. 6
The ransomware game has evolved.
Guest Allan Liska from Recorded Future joins Dave to discuss the evolution of ransomware and his new book "Ransomware: Understand. Prevent. Recover," Joe shares a question from listener Joan about an email her father received from "MasterCard Fraud Department" asking photo/video and the last 4 of his Social Security Number, Joe has a story about scams to watch out for during tax time in the US, Dave's story is about ransomware operators trying to recruit company insiders, and our Catch of the Da...
Feb 03, 2022•52 min•Season 4Ep. 182
OWASP broken access control (noun) [Word Notes]
Software users are allowed access to data or functionality contrary to the defined zero trust policy by bypassing or manipulating the installed security controls.
Feb 01, 2022•8 min•Season 2Ep. 82
Useful ransomware protection for you.
Guest Roger Grimes, Data Driven Defense Evangelist at KnowBe4, joins Dave to discuss his new book "Ransomware Protection Playbook," Dave has a story about a Meta (Facebook) group with a cryptocurrency scam that promises "a new way to wealth," Joe's story has tales of account takeover attacks of high-profile gamers, and our Catch of the Day is from listener Jesse about a text they received from "Facebook" about a $600,000 windfall. Links to stories: We Infiltrated a Crypto Scam Network That’s Hos...
Jan 27, 2022•45 min•Season 4Ep. 181
OWASP security misconfiguration (noun) [Word Notes]
The state of a web application when it's vulnerable to attack due to an insecure configuration.
Jan 25, 2022•7 min•Season 2Ep. 81
The perfect environment for ATOs (account takeovers) to breed.
Guest Jane Lee, Trust and Safety Architect at Sift, joins Dave to talk about the Digital Trust and Safety Index, Joe and Dave share some follow up from a listener, Ben, with a suggestion as an alternative to prevent clicking on those bonus phishing scams, Joe's story is about fake ticket scams for the Kansas City Chiefs NFL playoff game against the Pittsburgh Steelers, Dave's got a story about scams on Apple's App Store, and our Catch of the Day is from an anonymous listener about an email they ...
Jan 20, 2022•46 min•Season 4Ep. 180
OWASP insecure design (noun)
A broad OWASP Top 10 software development category representing missing, ineffective, or unforeseen security measures.
Jan 18, 2022•8 min•Season 2Ep. 80
The only locks you should pick are your own.
Guest Tom Tovar, CEO and Co-Creator of AppDome, joins Dave and Joe to discuss the results of a recent consumer survey, Dave's story is based on a tweet where the user's child's middle school had some unintended consequences of a phishing scam training, Joe has two stories: one on QR code scammers on parking kiosks, and one about a book publishing phishing scam, and our Catch of the Day is a message that purports to come from the USPS sent in by listener William about a missed package delivery. L...
Jan 13, 2022•45 min•Season 4Ep. 179
Log4j vulnerability (noun) [Word Notes]
An open source Java-based software tool available from the Apache Software Foundation designed to log security and performance information.
Jan 11, 2022•9 min•Season 2Ep. 83
Changing the game on ransomware.
Guest Adam Flatley, Director of Threat Intelligence at Redacted, talks with Dave about "the only way to truly disrupt the ransomware problem is to target the actors themselves," Joe shares some statistics that will help you stay up-to-date on recent cybersecurity trends, Dave's story is about criminal indictments in a case of a Maryland company buying lead paint victims’ settlements for a fraction of their value, and our Catch of the Day comes from listener Brady about a slick mail campaign they...
Jan 06, 2022•49 min•Season 4Ep. 178
OWASP injection (noun) [Word Notes]
A broad class of attack vectors, where an attacker supplies input to an applications command interpreter that results in unanticipated functionality.
Jan 04, 2022•7 min•Season 2Ep. 79
For the best experience, listen in Metacast app for iOS or Android