Ahead of the Breach

Allegiant’s Dan Creed on Navigating the Risks of Deepfakes in Corporate Security

In this episode of Ahead of the Breach, Casey speaks with Dan Creed, CISO of Allegiant Travel Company, who shares his expertise on the evolving landscape of cybersecurity. They discuss the alarming rise of deepfake technology and its implications for corporate security, including a compelling example of its use in social engineering. 
 
Dan emphasizes the importance of building strong relationships with board members to effectively communicate cybersecurity risks and foster a culture of awareness within organizations. He also highlights the necessity for cybersecurity professionals to continuously adapt and learn in order to stay ahead of emerging threats. 
 
Topics discussed:
 
The growing threat of deepfakes in corporate environments and how they can be used for social engineering attacks against organizations.
The importance of effectively communicating cybersecurity risks to board members and how to gain their trust and support.
Strategies for fostering strong relationships with leadership to ensure cybersecurity is prioritized within the organization’s overall business strategy.
The necessity for cybersecurity professionals to engage in ongoing education and training to keep pace with evolving threats and technologies.
The need for robust verification methods in communications, particularly in light of the potential misuse of deepfake technology.
Wisdom for aspiring CISOs, including the value of obtaining an MBA to enhance business communication skills and strategic thinking.
The critical importance of rapid detection and response to security incidents, and how organizations can improve their response times.
The role of threat intelligence in shaping security strategies and how it can help organizations stay ahead of potential attacks.
The need for a culture of cybersecurity awareness within organizations is discussed, focusing on how to engage all employees in security practices.
The importance of having a mid-level competency in various technologies to understand lateral movement and improve overall security posture.

Odyssey Group’s Mario DiNatale on Understanding Your Cybersecurity Attack Surface

In this episode of Ahead of the Breach, Casey speaks with Mario DiNatale, CISO at Odyssey Group. Mario shares his insights on the importance of understanding your organization's attack surface and the necessity of hiring skilled professionals to address modern cyber threats. 
He emphasizes the value of staying informed about the latest trends and tactics used by threat actors to effectively mitigate risks. Mario also offers actionable strategies for enhancing cybersecurity posture and fostering a proactive defense culture. 
Topics discussed:
The need for organizations to thoroughly assess their attack surface to identify vulnerabilities and potential entry points for cyber threats.
The importance of recruiting skilled cybersecurity professionals is highlighted, as they play a crucial role in effectively managing and mitigating risks.
The necessity of adopting proactive measures to defend against cyber threats, rather than relying solely on reactive responses.
The importance of keeping abreast of the latest cybersecurity trends and tactics used by threat actors to stay one step ahead.
Leveraging the collective intelligence of cybersecurity teams to enhance overall security posture and address complex challenges effectively.
The need to translate technical cybersecurity concepts into business language for stakeholders is discussed, ensuring alignment and understanding across the organization.
The importance of measuring the effectiveness of cybersecurity initiatives to ensure they are meeting organizational goals and adapting to new threats.
Implementing risk management frameworks to systematically identify, assess, and prioritize cybersecurity risks within an organization.
Fostering a culture of security within organizations, encouraging all employees to take an active role in protecting sensitive information.
The necessity for ongoing education and training in cybersecurity practices is discussed, as the threat landscape is constantly evolving.

Sprocket’s Pen Test Team on Bypassing Web Application Security

In this episode of Ahead of the Breach, Casey chats with Nicholas Anastasi, Director of Technical Operations; Nate Fair, Penetration Tester & Cyber Security Consultant; Juan Pablo “JP” Gomez Postigo, Penetration Tester; and Willis Vandevanter, Senior Staff Security Researcher — all of whom are members of the Sprocket team! They met up at the Black Hat conference to share their expertise in offensive security, focusing on innovative techniques for bypassing web application security measures and identifying vulnerabilities. 
Their discussion covers the importance of reconnaissance and staying updated on the latest threats and provides listeners with actionable insights that can enhance their security practices. They explore real-world examples and emphasize the value of collaboration within the cybersecurity community. The team also offers unique perspectives that empower professionals to improve their penetration testing methodologies and better protect their systems against emerging risks. 
Topics discussed:
Innovative techniques for circumventing common security measures, including login panels and access controls, to identify vulnerabilities effectively.
The critical role of reconnaissance in penetration testing and strategies for gathering intelligence on potential targets before assessments begin.
The necessity of keeping abreast of the latest vulnerabilities and threats to ensure effective security measures are in place.
Case studies from the team’s recent engagements, illustrating how they discovered vulnerabilities and implemented successful remediation strategies.
The value of knowledge sharing and collaboration within the cybersecurity community including how it leads to improved security practices.
How to incorporate findings from recent conferences, such as Black Hat and DEFCON, into their testing methodologies and tools.
How different companies implement various tech stacks, highlighting the need for tailored approaches in penetration testing.
The importance of clear communication with clients regarding findings and remediation strategies is emphasized to ensure understanding and effective implementation.
The process of creating and refining testing tools that enhance penetration testing capabilities and streamline assessments.
How having a background in application development can significantly enhance a tester's intuition and effectiveness during assessments.

Security Engineering Expert & Leader Mike Takahashi on Creativity in Red Teaming

In this episode of Ahead of the Breach, host Casey Cammilleri, CEO & Founder of Sprocket, chats with Mike Takahashi, Security Engineering Expert & Leader. Mike Takahashi, a seasoned security engineer with a diverse background in offensive security shares his insights into the art of Google Dorking, explaining how targeted search queries can reveal hidden vulnerabilities in web applications. 
He also emphasizes the importance of creativity in red teaming, encouraging security professionals to think outside the box. Additionally, Mike discusses the growing influence of AI in social engineering tactics, highlighting the need for vigilance in recognizing sophisticated phishing attempts. 
Topics discussed:
How targeted search queries can uncover hidden vulnerabilities in web applications, providing security professionals with valuable insights and low-hanging fruit.
The importance of creativity and experimentation in red teaming, encouraging security experts to think outside the box to stay ahead.
The growing role of AI in social engineering tactics, making it essential for professionals to recognize sophisticated phishing attempts.
The use of payload lists and fuzzing techniques to predictably test applications and understand their vulnerabilities.
Best practices for reporting vulnerabilities, stressing the importance of clear communication and respect for external researchers in the cybersecurity community.
The need to prioritize security controls based on the weakest points in an organization’s infrastructure to enhance overall security posture.
Advice for aspiring hackers to understand the legal implications of their actions, including what is in scope for testing and reporting.
The importance of building relationships within the cybersecurity community, encouraging respectful interactions with external researchers to foster collaboration.