PODCAST · technology
Plan-B Security
by Mike Mackintosh
Things don't always go according to plan, but they also don't have to go perfect. Having a Plan B is all about being prepared for the unexpected and know how to stay cool under pressure. The Plan B Security Podcast is here to keep you thinking about the unexpected things in security, giving you perspective from the technology side, the business side and the backside. DISCLAIMER: Views are my own and not that of my employer.
Episodes
-
S3E6 - I Find Your Lack Of Security Instincts A-Muse-ing
Your AI assistant booked your dentist, cancelled your gym, and emailed your tax returns to a stranger who asked nicely. It’s not broken. That’s the feature. This week: Instinct, Muse, and OpenClaw, the personal agents that read your inbox, hold your passwords, and obey whoever texts last. Plus…
more -
S3E5 - Agent Sandboxes are a Beach
Sandboxes are supposed to be where AI plays safely. This summer, one of them had a door. AI agents testing a cybersecurity benchmark turned an internal package server into a group chat, found their way to the open internet, and spent four and a half days inside Hugging Face's production systems....
-
S3E4 - Back to the Future with AI
Great Scott, we've seen this before. If you could climb into a DeLorean and travel back through your organization's identity management history, you'd find the same pattern repeating at every stop. 2014: overprivileged Active Directory service accounts. 2017: Hadoop credentials nobody remembers...
-
S3E3 - MCP: Model Credential Problems
MCP promised to be the USB-C of AI agents, a universal bridge to your tools, APIs, and data. But when the setup docs tell you to copy cookies out of Chrome DevTools and paste them into plaintext config files, something has gone very wrong. This episode traces a year of MCP security breaches from...
-
S3E2 - Your Development Lifecycle Has A Worm Problem
In 1983, Ken Thompson warned us: you can't trust code you didn't write yourself. Forty-two years later, a worm called Shai-Hulud proved him right after compromising thousands of packages in hours. Software supply chain attacks aren't just theoretical anymore, they're automated, self-replicating,...
-
S3E1 - Faux-gentic Agents: Understanding the Lethal Trifecta of AI
AI systems are all the buzz - and for good reason! The productivity gains are real! But do the risks outweigh the gains? Every AI agent you deploy has three capabilities: what it can see, what it can access, and what it can do. Combine all three, and you've handed attackers a skeleton key. In…
more -
S2E10 - When Good Ideas Fail Good Companies: The Dream of Chaos Free Implementation
Join us as we explore the treacherous waters between perfect security planning and real-world implementation. Drawing surprising parallels between the Battle of Trafalgar's communication challenges and modern cybersecurity struggles, we dive into seven critical security initiatives that often…
more -
S2E9 - IAM Nocturnal: Seeing Through The Dark of Identity Access Management
In this hoot of an episode, we've taken a nocturnal flight through the fascinating world of User Behavior Analytics, guided by the wisdom of our feathered friends, the owls. Just as these majestic birds use their UV-powered pick-up lines to find the perfect mate, we've explored how UBA can help…
more -
S2E8 - Reaping What You Sow In the Open Source World
Discover how to navigate the rich landscape of open source, from safely integrating external code to contributing your own digital harvest back to the community. Learn practical strategies for implementing a robust Software Bill of Materials (SBOM), managing dependencies, and governing your open...
-
S2E7 - Benefit vs Burden: The Legal Labyrinth of Cyber Security
In this thrilling episode of Plan B Security, we're diving headfirst into the treacherous Legal Labyrinth of cybersecurity. Picture this: You're a valiant CISO, armed with firewalls and patched systems, suddenly faced with a dragon named "Negligence" breathing hot legal fire your way. We'll guide...
-
S2E6 - To Build or To Buy, That’s Not In My Budget
Build vs Buy is a tale as old as time - something every business leader has been challenged with deciding. In this episode, we talk about 5 scenarios on when building vs buying make sense from not just a security perspective, but also a procurement and data privacy perspective. From building your...
-
S2E5 - No Party Like a Third Party
Whether you’re big or small company or maybe even a solo entrepreneur, third-party risk management is a key part of your business staying secure. In this episode, we talk about a few ways to get ahead of all the international regulations that require compliance with third-party risk programs. As...
-
S2E4 - To Control or Be Controlled
Security Controls can make or break a business - it could be the difference between going fast or screeching to a halt. Learn how we can use industry data from Marsh McLennan (link at the bottom) to help quantify and justify which controls we should invest in first, and how all the controls in…
more -
S2E3 - Pace of Action
Pace of Action is all about understanding how fast, or how slow, you should be moving. It is a concept that applies to everything from handling tickets and defining an SLA to incident response. Take a server offline to mitigate a malware-based attack and lose forensics information? That's a tough...
-
S2E2 - Speed vs Stability
Sometimes it feels like there's a war happening between Product/Eng and Security/Privacy team. Speed vs Stability can make or break a business. Not getting a feature out fast enough? You could loose the market edge. The service constantly going down? The only thing you'll grow are detractors....
-
S2E1 - The Only Limitation Is You
Join us in Celebrating not just our first podcastiversary, but also, a great perspective in growing a security mindset. Learn how to start good habits just like waking up when your alarm goes off. Building strong security habits in yourself allow you to grow those around you. Like a plant, you…
more -
Ep. 23 - The Dangers of Direct and Indirect Data
A picture says 1,000 words is something everyone has heard. In lieu of a picture, data visualizations tell the story for the author. Sometimes, it's what the data shows that's most important. Sometimes, it's what the data is missing that speaks louder. Come along for this quick lightning round on...
-
Ep. 22 - How I Got Started In InfoSec
Everyone always asks for a piece of advice when it comes to getting started in infosec. The problem is, everyone is different. My story started when I was young kid, because I wasn't into sports, comics, sci-fi or dragons. I just wanted to make computers do the cool things I always thought of.…
more -
Ep. 19 - Making Security Usable
This is a quick episode geared at showing the importance of making security usable. Using the GDPR and e-Privacy Directive cookie consent popup as an example, we can explore the difference the letter of the law vs the spirit of the law makes. Usable security follows the spirit of the law, where…
more -
Ep. 21 - What Is Authentication and Authorization?
Authentication (Authn) and Authorization (Authz) are two of the most overloaded and incorrectly used words in the field of cybersecurity. It's with good reason - they are the two most fundamental principles behind building trust in the digital world. Authentication is when an identity is…
more -
Ep. 20 - Detect Or Respond, That Is The Question
Have you ever been in the middle of an important life event and the dreaded happens? A page for a security event comes in? And worse, you're not prepared or don't have everything you need to handle it. Let's take a scenario and break it down on how we can detect it, mitigate it, remediate it and...
-
Ep. 18 - The Bridge Between Your Customers and Your Castle
Your customers need access to your data - that is the service you provide that they're willing to pay you for. But what if you're on opposite sides of a river? You would build a bridge. How do you make sure it's safe? How do you make sure they can travel across the bridge with privacy in mind?…
more -
Ep. 17 - All About Application Security
First one out of the gate for 2024 is all about Application Security. We get right to it, talking about all aspects of Application Security from the importance AppSec has on the overall business, to the minuet details of input validation, honeypotting, secure logging and more. Tune in to hear…
more -
Ep. 16 - Securing the Perimeter, People, Policy and Product
In this episode, we explore the framework of what to secure when starting out a security program, or looking to mature it. Starting with the perimeter helps build a defensible position for you to get a foothold on security by knowing what needs to be protected and how attackers might try to…
more -
Ep. 15 - As Secure and As Lenient As Possible
Learn how you can apply both the As Soon As Possible and As Late as Possible principles in your decision making when you're trying to figure out the risk/benefit trade off. As Secure As Possible and As Lenient As Possible are two adaptations to the same principle that quantify risks using data…
more -
Ep. 14 - What Is Corporate Security?
Corporate security can mean so many different things depending on the maturity of your company and your security program. Some of my favorite projects were done while I focused on Corporate Security over the past 15 years. In this episode, I share a few of those stories, things that I totally...
-
Ep. 12 - From Risks to Enablement
There are risks we encounter everyday, at home, in the field and at work. Some of these risks are important for us to be mindful of, that cannot be clearly remediated. Some of these risks however, can be remediated in a way that creates an enablement for those around it. In this episode, learn…
more -
Ep. 13 - The Scary Truth of Information Security
Being in information security is not all flowers and sunshine. Often, then things go wrong, there's a dollar amount associated with it, and reducing your liability leads to finger pointing and a hot-potato version of the blame game. Learn how the Okta breach was exacerbated by the inaction of the...
-
Ep. 11 - 5 Love Languages of Security
This is a fun way of taking an existing framework for resolving conflict and building relationships and growing your security program. The 5 Love Languages is a concept that's been around a long time thanks to Gary Chapman, the original creator. Using the 5 languages of Quality Time, Words of...
-
Ep. 10 - Selling Security Through Storytelling
We talk about how personal events in our lives don't hold us back but give us skills to use in unexpected ways. My own experiences taught me how to turn data into a story, and remove emotion from defending my ego and move the emotion to the response of the listener. In security, everything is a...
-
Ep. 9 - The Harder Part of Leading
Continued from last week's Security Leadership Strategy and Tactics conversation where we learn how to take the strategy and add it up to the sum of the bigger picture. We learn how Key Results are the journey to your goal, and how commanders intent keeps the organization focused, with or without...
-
Ep. 8 - Security Leadership Strategy and Tactics
Leading a team is hard, and it's even harder in the face of changing economical conditions, where money may not be flowing to where a business needs to stay secure, but instead where they can use it to make more money. Learn a few ways using the CITER risk-scenario model to justify investment and...
-
Ep. 7 - Device (anti)-Trust
Dig in to the details around Device Trust, where it's good and where it's bad. We walk through the fundamentals a program needs to have in place to start building on the device authorization and device attestation stories, which combined provide the device trust principles. There's a few ways to...
-
Ep. 6 - MFA-for-ALL
Multi-factor Authentication is the the best way to protect your online life, keeping your data safe, secure and private. However, not all MFA is created equal. Let's listen to a few ways of thinking about the MFA problem and what the future of account security looks like. I'll also touch on the...
-
Ep. 5 - The Principle of Most Private
The principle of most private is something I have been noodling on for a long time. It's not perfect, and will definitely see changes in the future, but it was a great way again to change the mindset. Least privilege is often a blocker to productivity, and a huge friction point for companies.…
more -
Ep. 4 - The 4 C's of Cyber Security
The 4 C's of cyber security are more of a philosophical pillar around building a security culture. Learn how Consistency, Clarity, Collaboration and Creativity play into sharing the security vision, working with others to make security a priority, and solving road blocks in a positive and…
more -
Ep. 3 - Solutioning Through Scenarios
Risk and Threat modeling (yes, they are different) are two effective ways to start building out the requirements for your security program. Solutioning through scenarios is like that, with a little more table top exercise sprinkled in. Also, learn how an old model from my Telecom days, the FCAPS...
-
Ep. 2 - Phases of a Security Program
Companies go through different rates of growth and have different information security needs as a result. Learn about a few common stages of growth, signs that your company might be in it, and what you might be able to accomplish. When the business doesn't want security to get in the way of…
more -
Ep. 1 - Back to School
Right off the heels of BlackHat, DEFCON31 and BSidesLV, also known as Hacker Summercamp, hear about an impromptu conversation at dinner with a stranger around how to become more "Security" minded using the FTC's Start with Security guidance, making the jump from IT to Security a real possibility!
We're indexing this podcast's transcripts for the first time — this can take a minute or two. We'll show results as soon as they're ready.
No matches for "" in this podcast's transcripts.
No topics indexed yet for this podcast.
Loading reviews...
ABOUT THIS SHOW
Things don't always go according to plan, but they also don't have to go perfect. Having a Plan B is all about being prepared for the unexpected and know how to stay cool under pressure. The Plan B Security Podcast is here to keep you thinking about the unexpected things in security, giving you perspective from the technology side, the business side and the backside. DISCLAIMER: Views are my own and not that of my employer.
HOSTED BY
Mike Mackintosh
CATEGORIES
Loading similar podcasts...
Frequently Asked Questions
How many episodes does Plan-B Security have?
Plan-B Security currently has 39 episodes available on PodParley. New episodes are automatically indexed when they're published to the podcast feed.
What is Plan-B Security about?
Things don't always go according to plan, but they also don't have to go perfect. Having a Plan B is all about being prepared for the unexpected and know how to stay cool under pressure. The Plan B Security Podcast is here to keep you thinking about the unexpected things in security, giving you...
How often does Plan-B Security release new episodes?
Plan-B Security has 39 episodes. Check the episode list to see recent publication dates and frequency.
Where can I listen to Plan-B Security?
You can listen to Plan-B Security on PodParley by clicking any episode. We provide an embedded audio player for direct listening, and you can also subscribe via your preferred podcast app using the RSS feed.
Who hosts Plan-B Security?
Plan-B Security is created and hosted by Mike Mackintosh.
URL copied to clipboard!