Stuck in Traffic – Fireball

Fireball malware and browser hijacking.

Watch more videos on my YouTube channel.

A study in Beethoven finds he was often surprised by which music succeeded and which failed. In much the same way, we’re often surprised at which security initiatives take off and which stall. Trick is, experimenting with several initiatives at once.

Watch more videos on my YouTube channel.

What’s more risky: flying or driving? What’s more likely: shark bites or dog bites? What’s more vulnerable: servers or Web apps?

Watch more videos on my YouTube channel.

Segregation of duties and least privilege are fundamental concepts in information security. But they need to be applied in a way that doesn’t overly slow down the pace of business. Here’s one approach for how to do this in DevOps.

Watch more videos on my YouTube channel.

The application security concepts of impedance and impedance mismatch. With that, we can bypass Web application firewalls (WAF). Defense? Put the controls as close to the app as possible.

Watch more videos on my YouTube channel.

The idea is using games like Minecraft to share security awareness ideas with our kids. (The reality is that I was pwned by my daughter.) Small things, fun things, repeated regularly and frequently, are the ways we communicate culture.

Watch more videos on my YouTube channel.

Writing code to gracefully handle disasters and outages. Have a horror story of this gone wrong? Let me know!

Watch more videos on my YouTube channel.

DevOps has this concept of “blameless postmortems”. Developers and engineers explain what happened. But they aren’t blamed. They aren’t fired. It’s a learning and improvement opportunity. So how can we apply this to information security?

Watch more videos on my YouTube channel.

A few ideas for protecting customers by securing Point of Sale (POS) Systems. This following the Chipotle breach of practically all their POS terminals.

Watch more videos on my YouTube channel.

And the Clouds Break: Continuity in the 21st Century

The promise of cloud computing was a utility; always up, always on, just a click away. But we’ve seen many outages. It’s clearly time to blow the dust off the continuity handbook, and revisit recovery for the twenty-first century. This talk provides an overview of business impact analysis, business continuity, and disaster recovery. We then revisit these concepts in the day and age of utility computing and Cloud services. After all, the cloud breaks.

(Friday, June 9, 2017. Indianapolis, Indiana)

Watch more videos on my YouTube channel.