Black Hat Podcasts

Byron Acohido · Taking a wartime approach to defending networks.

Black Hat Fireside Chat: Taking the fight to the adversaries — with continuous, proactive ‘pen tests’

By Byron V. Acohido

Penetration testing – pen tests – traditionally have been something companies might do once or twice a year.

Bad news is always anticipated. That’s the whole point. The pen tester’s assignment is to seek out and exploit egregious, latent vulnerabilities – before the bad guys — thereby affording the organization a chance to shore up its network defenses.

Pen testing has limitations, of course. The probes typically take considerable effort to coordinate and often can be more disruptive than planned.

These shortcomings have been exacerbated by digital transformation, which has vastly expanded the network attack surface.

Guest expert: Snehal Antani, CEO, Horizon3.ai

I had the chance at Black Hat 2022 to visit with Snehal Antani and Monti Knode, CEO and director of customer success, respectively, at Horizon3.ai, a San Francisco-based startup, which launched in 2020. Horizon3 supplies “autonomous” vulnerability assessment technology.

Co-founder Antani previously served as the first CTO for the U.S. Joint Special Operations Command (JSOC) and Knode was a commander in the U.S. Air Force 67th Cyberspace Operations Group. They argue that U.S. businesses need to take a wartime approach the cybersecurity. For a full drill down, please give the accompanying podcast a listen.

Horizon3’s flagship service, NodeZero, is designed to continuously assess an organization’s network attack surface to identify specific scenarios by which an attacker might combine stolen credentials with misconfigurations or software flaws to gain a foothold.

Byron Acohido · Addressing the yin and yang of APIs

Black Hat Fireside Chat: Doing deep-dive API security — as software gets developed and deployed

By Byron V. Acohido

APIs have come to embody the yin and yang of our digital lives.

Without application programming interface, all the cool digital services we take for granted would not be possible.

But it’s also true that the way software developers and companies have deployed APIs has contributed greatly to the exponential expansion of the cyber-attack surface. APIs have emerged as a go-to tool used by threat actors in all phases of sophisticated, multi-stage network attacks.

Upon gaining a toehold on a targeted device or server, attackers now quickly turn their attention to locating and manipulating available APIs to hook deeply into company systems. APIs provide paths to move laterally, to implant malware and to steal data.

Guest expert: Sudeep Padiyar, founding member, Traceable.ai

The encouraging news is that API security technology has advanced quite a bit over the past five years or so.

I had the chance at Black Hat 2022 to visit with Sudeep Padiyar, founding member and director of product management, at Traceable, a San Francisco-based supplier of advanced API security systems. Traceable launched in 2018, the brainchild of tech entrepreneurs Jyoti Bansal and Sanjay Nagaraj; it provides deep-dive API management capabilities — as software is being developed and while it is being used in the field.

We discussed the Gordian-knot challenge security teams face getting a grip on the avalanche of APIs hooking into their organizations. For a full drill down, please give the accompanying podcast a listen.

Byron Acohido · Leveraging AI to reduce API risk, manage the attack surface

Black Hat Fireside Chat: Deploying ‘AI’ as a weapon to win the ‘attack surface management’ war

By Byron V. Acohido

Short-handed cybersecurity teams face a daunting challenge.

In an intensely complex, highly dynamic operating environment, they must proactively mitigate myriad vulnerabilities and at the same time curtail the harm wrought by a relentless adversary: criminal hacking collectives.

In short, attack surface management has become the main tent pole of cybersecurity. A rock-solid, comprehensive battle plan has been painstakingly laid out, in the form of the NIST Cybersecurity Framework. And now advanced weaponry is arriving that leverages data analytics to tighten up systems and smother attacks.

Guest expert: Justin Fier, VP Tactical Risk and Response, Darktrace

One supplier in the thick of this development is Cambridge, UK-based Darktrace, a supplier of security systems designed to help companies“think like an attacker,’ says Justin Fier, Darktrace vice-president of tactical risk and response, whom I had the chance to visit with at Black Hat 2022.

We discussed how legacy, on-premises cybersecurity systems generate massive amounts of telemetry – data which is perfectly suited for high-scale, automated data analytics. This is why it makes so much sense for artificial intelligence, generally, to be brought to bear in attack surface management.

Byron Acohido · The supplanting of VPNs by ZTNA

Black Hat Fireside Chat: Replacing VPNs with ZTNA that leverages WWII battlefield tactics

By Byron V. Acohido

The sunsetting of Virtual Private Networks is underway.

VPNs are on a fast track to becoming obsolete, at least when it comes to defending enterprise networks. VPNs are being replaced by zero trust network access, or ZTNA.

VPNs encrypt data streams and protect endpoints from unauthorized access, essentially by requiring all network communications to flow over a secured pipe. VPNs verify once and that’s it. This was an effective approach when on-premises data centers predominated.

By contrast, ZTNA never trusts and always verifies. A user gets continually vetted, per device and per software application — and behaviors get continually analyzed to sniff out suspicious patterns.

Guest expert: Rajiv Pimplaskar, CEO, Dispersive

This new approach is required — now that software-defined resources scattered across hybrid and public clouds have come to rule the day.

I had the chance at Black Hat 2022 to visit with Rajiv Pimplaskar, CEO at Dispersive, an Alpharetta, GA-based supplier of advanced cloud obfuscation technology. We discussed how ZTNA has emerged as a key component of new network security frameworks, such as secure access service edge (SASE) and security service edge (SSE)

We also spoke about how Dispersive is leveraging spread spectrum technology, which has its roots in World War II submarine warfare, to more effectively secure modern business networks. For a full drill down on our forward-looking discussion, please give the accompanying podcast a listen.

Byron Acohido · The going-forward role for full-service MSSPs

Black Hat Fireside Chat: MSSPs are well-positioned to help companies achieve cyber resiliency

By Byron V. Acohido

Network security is in dire straits. Security teams must defend an expanding attack surface, skilled IT professionals are scarce and threat actors are having a field day.

That said, Managed Security Services Providers – MSSPs — are in a position to gallop to the rescue.

MSSPs arrived on the scene 15 years ago to supply device security as a contracted service: antivirus, firewalls, email security and the like.

They’ve progressed to supplying EDR, SIEM, threat intel platforms and numerous other advanced network security services on an outsourced basis.

Guest expert: Chris Prewitt, CTO, Inversion6

Today, big IT services companies, as well as legacy cybersecurity vendors, are hustling to essentially give shape to the next-gen MSSP, if you will. The leading players are partnering and innovating to come up with the optimum portfolio of services.

I had the chance to visit at Black Hat 2022 with Christopher Prewitt, CTO at Inversion6, a Cleveland-based supplier of managed IT security services. We discussed how far MSSPs have come since the early 2000s, when the focus was on helping companies do check-the-box compliance. For a full drill down on our forward-looking discussion, please give the accompanying podcast a listen.

Going forward, MSSPs seemed destined to play a foundational role in enabling digital commerce. They could help enterprises and SMBs overcome the IT skills shortage, truly mitigate cyber risks and comply with audit requirements, to boot.

Byron Acohido · The intricacies of overlapping cyber attacks

Black Hat insights: Getting bombarded by multiple ransomware attacks has become commonplace

By Byron V. Acohido

The top ransomware gangs have become so relentless that it’s not unusual for two or more of them to attack the same company within a few days – or even a few hours.

Related: How ‘IABs’ foster ransomware

And if an enterprise is under an active ransomware attack, or a series of attacks, that’s a pretty good indication several other gangs of hacking specialists came through earlier and paved the way.

In short, overlapping cyber attacks have become the norm. This grim outlook is shared in a new white paper from Sophos. The report paints a picture of ransomware gangs arriving on the scene typically after crypto miners, botnet builders, malware embedders and initial access brokers may have already profited from earlier intrusions.

I had the chance to discuss these findings last week at Black Hat USA 2022, with John Shier, senior security advisor at Sophos, a next-generation cybersecurity leader with a broad portfolio of managed services, software and hardware offerings. For a drill down on our discussion, please give the accompanying podcast a listen. Here are the key takeaways:

Common infection paths

Security teams face a daunting challenge. They must detect and remediate multiple cyber attacks by numerous, determined hacking groups, sometimes coming at them simultaneously and quite often seeking different objectives.

Byron Acohido · The coming impact of SBOM: software bill of materials

Black Hat insights: How to shift security-by-design to the right, instead of left, with SBOM, deep audits

By Byron V. Acohido

There is a well-established business practice referred to as bill of materials, or BOM, that is a big reason why we can trust that a can of soup isn’t toxic or that the jetliner we’re about to board won’t fail catastrophically

A bill of materials is a complete list of the components used to manufacture a product. The software industry has something called SBOM: software bill of materials. However, SBOMs are rudimentary when compared to the BOMs associated with manufacturing just about everything else we expect to be safe and secure: food, buildings, medical equipment, medicines and transportation vehicles.

An effort to bring SBOMs up to par is gaining steam and getting a lot of attention at Black Hat USA 2021 this week in Las Vegas. President Biden’s cybersecurity executive order, issued in May, includes a detailed SBOM requirement for all software delivered to the federal government.

ReversingLabs, a Cambridge, MA-based software vendor that helps companies conduct deep analysis of new apps just before they go out the door, is in the thick of this development. I had the chance to visit with its co-founder and chief software architect Tomislav Pericin. For a full drill down on our discussion please give the accompanying podcast a listen. Here are the big takeaways:

Gordian Knot challenge

The software industry is fully cognizant of the core value of a bill of materials and has been striving for a number of years to adapt it to software development.

Older Articles »

The Last Watchdog

Black Hat Podcasts

Black Hat Fireside Chat: Taking the fight to the adversaries — with continuous, proactive ‘pen tests’

By Byron V. Acohido

Black Hat Fireside Chat: Doing deep-dive API security — as software gets developed and deployed

By Byron V. Acohido

Black Hat Fireside Chat: Deploying ‘AI’ as a weapon to win the ‘attack surface management’ war

By Byron V. Acohido

Black Hat Fireside Chat: Replacing VPNs with ZTNA that leverages WWII battlefield tactics

By Byron V. Acohido

Black Hat Fireside Chat: MSSPs are well-positioned to help companies achieve cyber resiliency

By Byron V. Acohido

Black Hat insights: Getting bombarded by multiple ransomware attacks has become commonplace

By Byron V. Acohido

Black Hat insights: How to shift security-by-design to the right, instead of left, with SBOM, deep audits

By Byron V. Acohido