Root Causes 389: 2024 RSA Conference Wrap Up
Jason and I do our annual RSA wrap-up. Trending segments include AI, Trust Centers, MFA, PQC, and more.
May 28, 2024•27 min
Root Causes: A PKI and Security Podcast
Digital certificate industry veterans Tim Callan and Jason Soroko explore the issues surrounding digital identity, PKI, and cryptographic connections in today's dynamic and evolving computing world. Best practices in digital certificates are continually under pressure from technology trends, new laws and regulations, cryptographic advances, and the evolution of our computing architectures to be more virtual, agile, ubiquitous, and cloud-based. Jason and Tim (and the occasional guest subject matter expert) will help you stay current on developments in this essential technology platform and to understand the whys and wherefores of popular Public Key Infrastructures.
Last refreshed: ⓘ
Follow this podcast in the Metacast mobile app to refresh it and see new episodes.
Podcasts are better in Metacast mobile app
Don't just listen to podcasts. Learn from them with transcripts, summaries, and chapters for every episode. Skim, search, and bookmark insights. Learn more
Episodes
Root Causes 388: What Is the WebPKI?
These days we frequently discuss "the WebPKI." But what does that really mean? In this episode we define the term and explain how this definition evolved over time. We give an inventory of a main components of the WebPKI and discuss what's required to become a CA.
May 22, 2024•26 min
Root Causes 387: What Is the Post-quantum Readiness of HSMs?
We take a deep dive with return guest Bruno Coulliard on HSMs and the role they play in post-quantum cryptography (PQC).
May 16, 2024•32 min
Root Causes 386: Meta Commits MITM Attack On Its Users
Recent court documents reveal that in 2016 Meta (then Facebook) set up a system to get around encryption and spy on traffic between its users and competing social media platforms. We explain what happened.
May 13, 2024•14 min
Root Causes 385: Failed Revocation and Wildcard Certificates
We discuss misuse of wildcard certificates, failure to revoke on time, and how these two failures magnify each other.
May 10, 2024•12 min
Root Causes 384: So What Is a Senior Fellow Anyway?
Jason has a new title, Senior Fellow. In this episode Jason explains what his new focus will be and how this will be good for Root Causes.
May 07, 2024•7 min
Root Causes 383: Delayed Revocation Events by the Numbers
An epidemic of delayed revocations has infected the public CA community. We track delayed revocations since the beginning of 2021, examine the trend line, and discuss root causes.
May 02, 2024•25 min
Root Causes 382: Mobile Phone Malware Steals Faces for Access
New malware photographs users' faces to defeat authentication mechanisms. We explain the that biometrics are not "secrets" and discuss the continuing progression of attacks to steal biometrics.
Apr 29, 2024•12 min
Root Causes 381: Apple Chip Sideloading Attack Leaks Encryption Keys
A newly revealed side channel attack enables theft of private keys from M-series Apple chips. We explain.
Apr 26, 2024•8 min
Root Causes 380: What If Quantum Supremacy Comes Earlier Than We Thought?
Repeat guest Bruno Coulliard gives us an update on the US government's migration to post-quantum cryptography (PQC). We talk about the challenges to migration, the possibility of a black swan event in achieving quantum supremacy, and what happens if we all respond by pressing the "panic button" at the same time.
Apr 22, 2024•30 min
Root Causes 379: AI-generated Fake IDS for KYC
Inexpensive and easily obtained deepfake photographs of IDs, generated by AI, are available online. These pose a problem for KYC initiatives.
Apr 18, 2024•13 min
Root Causes 378: Why Are Forced Revocations So Difficult?
In the latest in our ongoing series of discussions of the Bugzilla Bloodbath, we delve deep into the problem of failure to revoke on time and the multiple causes that lead to this ongoing failure. And what to do about them.
Apr 15, 2024•21 min
Root Causes 377: Is CPS/Issuance Misalignment a Revocation Event?
If you issue public certificates that are fully compliant except that they do not reflect what your CPS says, are they misissued? Do they require revocation? This is a question with real stakes as we see multiple current instances of a CA denying revocation for that reason. In this episode we explore this issue.
Apr 11, 2024•17 min
Root Causes 376: Gartner's New CLM Framework
Gartner has released a new framework for Certificate Lifecycle Management, called the Seven Core Functions of Certificate Automation. We walk through this framework and answer how it fits in with our own Five Pillars of CLM.
Apr 08, 2024•19 min
Root Causes 375: What Is Name Space Lifecycle Management?
In this guest episode we discuss name space hygiene with Geir Rasmussen, founder of NodeZro. CNAMEs, SPF, DMARC, name server entries, and other DNS identifiers, left unattended, can expose companies to identity-based attacks. We lay out the steps in addressing name space cleanup.
Apr 05, 2024•28 min
Root Causes 374: NIST Cyber Security Framework 2 Released
NIST Cyber Security Framework version 2.0 is released. It includes guidance on identity management and authentication. In this first episode of a series, we describe this framework's basic structure and its effect on industry.
Mar 31, 2024•15 min
Root Causes 373: Massive Brand Hijack Subverts More Than 21,000 Domains and Subdomains
A massive name space attack has hijacked more than 21,000 domains and subdomains, including a who's who list of major global brands. This huge and innovative attack takes advantage of inherited trust in abandoned domains. We explain what is happening.
Mar 29, 2024•15 min
Root Causes 372: Bugzilla Bloodbath
It's a bloodbath on Bugzilla. Since March 9, more than 25 new Bugzilla bugs been written up, which is 10x the typical pace. And it's not over. In this episode we explain what is going on and why.
Mar 26, 2024•22 min
Root Causes 371: MPIC Rules Go to CABF Ballot
A ballot for Multi-perspective Issuance Corroboration (MPIC), formerly known as MPDV, has entered a discussion period in the CA/Browser Forum (CABF). We explain the details of what it contains.
Mar 22, 2024•20 min
Root Causes 370: Drama on Bugzilla
An evolving incident on Bugzilla has garnered a lot of attention and touches several important issues in the WebPKI ecosystem. We report what went on and unpack the issues involved.
Mar 19, 2024•28 min
Root Causes 369: iMessage to Be PQC Enabled
Apple has announced that iMessage will employ post-quantum cryptography (PQC). We explain the implications of this announcement.
Mar 14, 2024•15 min
Root Causes 368: CRYSTALS-Kyber Is Now ML-KEM
What has been known as CRYSTALS-Kyber now has the new official name of Module Lattice-based Key Encryption Module, or ML-KEM. We give an update on the state of the NIST round 3 winners.
Mar 13, 2024•9 min
Root Causes 367: Did an IoT Toothbrush Botnet Perform DDoS Attacks?
A story circulated earlier this year about a botnet composed of millions of IoT toothbrushes, which later was debunked. We tell you the whole tale.
Mar 07, 2024•8 min
Root Causes 366: What Is eIDAS?
eIDAS 2.0 has been making headlines recently with its proposed expansion to the European digital identity ecosystem. But what is eIDAS? What does it do, and why does it exist? In this episode we give you the basics.
Mar 04, 2024•27 min
Root Causes 365: What Is Subdomain Hijacking?
In this episode we explain subdomain hijacking, including dangling subdomains and how they can constitute vulnerabilities.
Feb 26, 2024•14 min
Root Causes 364: Video Conference Deepfake Enables $25 Million Theft
Deepfakes continue to show themselves as part of the standard criminal toolkit. A recent deepfake spear phish enabled a $25 million Business Email Compromise (BEC). We explain what happened.
Feb 22, 2024•9 min
Root Causes 363: Defending Yourself Against Use of Stolen Privileges
CloudFlare recently published details of an attack it suffered as a downstream effect of a November 2023 breach against Okta and what it did to nullify its success. We discuss the steps enterprises can take to protect themselves against malicious use of stolen access credentials.
Feb 18, 2024•8 min
Root Causes 362: When You're Attacked by a State Actor
In this episode we share the details of a recent nation state actor attack on Microsoft and some of the lessons learned.
Feb 12, 2024•10 min
Root Causes 361: The Premise of on Premise
In this episode we examine commonly held belief that on-premise systems give system administrators greater levels of control and that that is better for security or other reasons. We explore the pros and cons of extra control, to what degree it is a benefit, and if it's worth it.
Feb 09, 2024•37 min
Root Causes 360: Joe Biden Deepfake Plays in New Hampshire Primary
A deepfake of Joe Biden's voice made an appearance in robocalls leading up to the New Hampshire primary. We discuss this latest development and its implications.
Feb 06, 2024•12 min
For the best experience, listen in Metacast app for iOS or Android