Defensive Security Podcast Episode 283

Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec

“They Can’t All Be Winners”

In this episode of the Defensive Security Podcast, hosts Jerry Bell and Andrew Kalat explore several pressing cybersecurity topics as of October 2024. The discussion begins by addressing the rapid increase in vulnerability exploitation speeds, with a highlight that 70% of exploitable flaws in 2023 were zero-days, now being exploited within just five days. They stress the importance of effective patch management and prioritization tactics using tools like the CISA KEV list and Tenable’s Viper score. The episode also touches on the evolving nature of automated and targeted exploits, the critical role of timely patching, and the balance between production disruptions and security risks. The conversation broadens to include evolving endpoint security challenges, ransomware trends, and the need for vigilance in adapting to new threats. Additionally, the hosts discuss innovative ways to counter sophisticated attacks, such as leveraging more secure token-based authentication methods over SMS-based MFA. Lastly, the episode delves into how North Korean IT operatives infiltrate companies to steal sensitive data, the implications for remote work, and the importance of robust identity verification processes in hiring. Throughout, the focus remains on adapting to the dynamic threat landscape and continuous reassessment of security strategies.

00:00 Introduction and Casual Banter

00:41 Current Job Market Challenges

02:02 Cybersecurity Landscape Overview

02:20 Google’s Zero-Day Vulnerability Report

04:03 Importance of Patch Management

05:04 Trends in Exploitation Timelines

11:24 Strategies for Mitigating Vulnerabilities

20:03 Red Team Tool: EDR Silencer

26:52 Microsoft’s Ransomware Defense

27:25 Ransomware Attacks: A Decrease Despite the Increase

28:13 The Role of Unmanaged Devices in Cyber Attacks

28:39 Multi-Factor Authentication: Effectiveness and Adaptation

30:07 The Arms Race in Cybersecurity

30:49 The Importance of Phishing-Resistant MFA

32:11 The Rise of SIM Cloning in Ransomware

32:44 Challenges in Adopting Advanced Security Measures

36:46 North Korean IT Workers: A New Threat

40:50 The Future of Remote Hiring and Verification

49:03 Conclusion and Final Thoughts

Links:

• https://www.bleepingcomputer.com/news/security/google-70-percent-of-exploited-flaws-disclosed-in-2023-were-zero-days/
• https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html
• https://www.theregister.com/2024/10/15/microsoft_ransomware_attacks/
• https://www.bleepingcomputer.com/news/security/undercover-north-korean-it-workers-now-steal-data-extort-employers/