Patching – The Security Ledger with Paul F. Roberts

In this spotlight edition* of The Security Ledger Podcast, Steve Hanna of Infineon joins us to talk about the growing risk of cyber attacks on industrial systems and critical infrastructure. "Industry 4.0" is poised to transform the global economy, Hanna said, but not if the issue of cyber risk can't be managed. We talk about how that might be done and the need for strong identity and hardware based roots of trust! The post Spotlight: as Attacks Mount, how to secure the Industrial Internet appeared first on The Security Ledger with Paul F. Roberts.

What makes a good CSO? In the wake of the Equifax breach, we talk about the controversy over that company’s CSO’s music degree. Also: we talk with Signal Sciences about why companies keep getting hacked via application vulnerabilities like the Apache Struts hole that felled Equifax. What makes a good CSO? In the wake of the Equifax breach, we are using this week’s Security Ledger podcast to talk about the controversy over that company’s CSO’s music degree.  Deidre Diamond, the CEO and founder of the placement firm CyberSN talks to us about what companies are looking for in Chief Security Officers. Also: Chris Roberts, the noted hacker known as @sidragon1 and Chief Security Architect at the firm Acalvio, talks about the convention of unconventional paths to the information security space. Roberts recounts his own twisting path to the information security space as a young hacker coming of age in the 1980s. Diamond […] The post After Equifax: What Makes a Good CSO? Also: App Sec is a Mess. We Talk about Why. appeared first on The Security Ledger with Paul F. Roberts.

Like everyone else, we wrote extensively in the last month about the serious security vulnerability in OpenSSL dubbed “Heartbleed,” which affected many of the world’s leading web sites and services, including Facebook and Google. The large-type headlines about Heartbleed have passed. But that doesn’t mean that the danger has. As we have noted,  we are entering a phase that might be considered Heartbleed’s ‘long tail.’ Most of the well-trafficked websites that were vulnerable to Heartbleed have gotten around to fixing the vulnerability. But public-facing web servers are only the beginning of the story for OpenSSL. Chasing down the vulnerability’s long tail in third-party applications and on internal web sites and applications is a much larger task. As I’ve noted: open source components make their way into all manner of applications and bespoke products these days, often without any effort to assess the security of the borrowed code. For companies that need to protect critical IT […] The post Podcast: Is Defense-In-Depth The Only Real Heartbleed Fix? appeared first on The Security Ledger with Paul F. Roberts.