Coordinated Cyber Defense: Inside Vulnerability Disclosure Programs (VDP)

CISO Insights: Voices in Cybersecurity

Player FM - Internet Radio Done Right

Added thirty-one weeks ago

محتوای ارائه شده توسط CISO Marketplace. تمام محتوای پادکست شامل قسمت‌ها، گرافیک‌ها و توضیحات پادکست مستقیماً توسط CISO Marketplace یا شریک پلتفرم پادکست آن‌ها آپلود و ارائه می‌شوند. اگر فکر می‌کنید شخصی بدون اجازه شما از اثر دارای حق نسخه‌برداری شما استفاده می‌کند، می‌توانید روندی که در اینجا شرح داده شده است را دنبال کنید.https://fa.player.fm/legal

Action Academy | Replace The Job You Hate With A Life You Love

1
How To Replace A $100,000+ Salary Within 6 MONTHS Through Buying A Small Business w/ Alex Kamenca & Carley Mitus 57:50

1 year پیش57:50

پخش در آینده

لیست ها

پسندیدن

دوست داشته شد

57:50

Alex (@alex_kamenca) and Carley (@carleymitus) are both members of our Action Academy Community that purchased TWO small businesses last thursday! Want To Quit Your Job In The Next 6-18 Months Through Buying Commercial Real Estate & Small Businesses? 👔🏝️ Schedule A Free 15 Minute Coaching Call With Our Team Here To Get "Unstuck" Check Out Our Bestselling Book : From Passive To Passionate : How To Quit Your Job - Grow Your Wealth - And Turn Your Passions Into Profits Want A Free $100k+ Side Hustle Guide ? Follow Me As I Travel & Build: IG @brianluebben ActionAcademy.com…

28 روز پیش 23:17

MP3•خانه قسمت

This podcast dives into the critical world of vulnerability disclosure programs (VDPs), exploring how organizations and security researchers work together to identify and address security weaknesses. We'll examine the core principles that underpin effective VDPs, including establishing clear reporting channels and defined scopes, the importance of timely responses and good-faith engagement, and the crucial role of safe harbor provisions. We'll also delve into modern best practices such as automation in triage, integration with security workflows, adherence to coordinated vulnerability disclosure (CVD) norms, and the benefits of transparency in building community trust. Join us to understand how VDPs are becoming a strategic necessity for cyber resilience, fostering a collaborative security ecosystem.

www.hackernoob.tips/diving-deep-a-researchers-guide-to-navigating-vulnerability-disclosure-programs

www.securitycareers.help/establishing-a-vulnerability-disclosure-program-a-cisos-perspective

https://irmaturityassessment.com

https://cyberinsurancecalc.com

136 قسمت

#Tech #News #Tech News #CISO Marketplace

Coordinated Cyber Defense: Inside Vulnerability Disclosure Programs (VDP)

CISO Insights: Voices in Cybersecurity

published 28 روز پیش

اشتراک گذاری

MP3•خانه قسمت

www.hackernoob.tips/diving-deep-a-researchers-guide-to-navigating-vulnerability-disclosure-programs

www.securitycareers.help/establishing-a-vulnerability-disclosure-program-a-cisos-perspective

https://irmaturityassessment.com

https://cyberinsurancecalc.com

136 قسمت

#Tech #News #Tech News #CISO Marketplace

همه قسمت ها

1
2025 Cyber Attack Playbooks: Navigating the Future Threat Landscape 42:13

17 hours پیش42:13

42:13

This podcast delves into the critical insights found within the 2025 Cybersecurity Attacks Playbooks, exploring the diverse and evolving threat landscape organizations face. We examine playbooks covering threats from AI-enhanced phishing and advanced ransomware to the complexities of supply chain compromises, zero-day exploits, and AI-powered malware. We also discuss emerging threats like deepfake social engineering, quantum computing vulnerabilities, and securing IoT devices. Each episode breaks down the essential stages outlined in the playbooks for specific attacks: Preparation to build foundational defenses, Detection to identify threat indicators, Analysis to understand the attack's scope and methods, Containment/Eradication tailored to the specific threat vector, and Recovery to restore operations and resilience. Gain a deeper understanding of modern attack vectors like credential stuffing, fileless malware, rogue access points, SQL injection, steganography-based data exfiltration, and cache poisoning, as well as network attacks like homograph attacks, Denial-of-Service (DoS), and watering hole attacks, and complex infiltrations like island hopping and Advanced Persistent Threats (APTs). Tune in to learn how the playbooks guide organizations through detection, response, and the vital Lessons Learned process to continuously improve their cybersecurity posture. www.securitycareers.help/navigating-the-2025-threat-landscape-preparing-for-and-responding-to-advanced-cyber-attacks…

1
Beyond the Scan: Unmasking Hidden Risks and Unfixed Flaws in the Age of AI 20:13

1 day پیش20:13

20:13

In this episode, we dive deep into the findings of the State of Pentesting Report 2025 to explore the real state of cybersecurity. Organizations may feel confident, but pentesting consistently reveals hidden, exploitable vulnerabilities that automated scanners miss. We'll uncover the most significant risks identified through human-led pentests, from common web and mobile application flaws like Server Security Misconfiguration and Missing Access Control to the rapidly emerging and uniquely challenging security issues in AI and Large Language Models (LLMs). Learn why AI/LLM tests have a significantly higher proportion of serious findings and the specific threats like Insecure Output Handling, Prompt Injection, and Unbounded Consumption. More critically, we'll address the disconnect between perceived security and reality by examining why less than half of all findings ever get resolved and how even serious vulnerabilities often remain open for months or years, far exceeding targeted SLAs. We'll explore the factors influencing this remediation struggle, including criticality, pentest type, organizational size, industry, and internal processes. Tune in to understand the critical need for a programmatic approach to offensive security and the challenges teams face in fixing what pentesters find. www.securitycareers.help/beyond-the-scan-the-hidden-reality-of-unfixed-security-risks-revealed-by-pentesting-data…

1
Building Cyber Warriors: The Evolving Cyber Professional 33:42

۳ روز پیش33:42

33:42

In the dynamic world of cybersecurity, professionals face constant challenges that demand adherence to strict ethical and legal guidelines. This episode delves into the key ethical and legal considerations, such as protecting individual privacy, ensuring robust data protection, maintaining confidentiality, and complying with relevant laws and regulations like GDPR and CCPA. We discuss responsible practices like vulnerability disclosure and the ethical use of cybersecurity tools. Given the ever-evolving landscape of cybersecurity threats and technologies, staying updated is not optional; it's an imperative for success. Join us as we explore why continuous education and professional development are essential strategies for cybersecurity professionals to navigate this complex terrain, adapt to emerging trends, maintain expertise, and uphold trust. https://cisomarketplace.services/careers www.securitycareers.help/building-cyber-warriors-the-imperative-of-the-evolving-cyber-professional…

1
The Iceberg Impact: Unpacking the Hidden Costs of Cyber Attacks 16:24

۴ روز پیش16:24

16:24

Join us as we delve into the complex and pervasive world of cyber risk, exploring the threats, vulnerabilities, and far-reaching consequences for organizations today. Drawing on insights from experts, we'll discuss how cyber attacks can lead to outcomes ranging from regulatory fines and reputational loss to the complete failure of a business. Go beyond the headlines of data breaches and understand the full "iceberg impact" of cyber losses, including significant uninsurable costs like reputational damage, loss of customers, stock devaluation, and devaluation of intellectual property that often exceed the direct financial costs. We'll explore how attacks threaten critical corporate data, intellectual property, and customer details, potentially causing financial loss and damage to market value, share price, and competitive advantage. The conversation will touch upon the challenges posed by mobile devices, social media, and supply chain vulnerabilities, and the critical need for organizations to accurately assess their cyber risk exposure, identify their "crown jewels" of critical data, and prepare for inevitable incidents through robust incident management and layered defenses. www.securitycareers.help/the-iceberg-impact-navigating-the-full-scope-of-cyber-risk-in-the-digital-age www.compliancehub.wiki/cyber-risk-through-a-compliance-lens-navigating-the-regulatory-landscape…

1
The MAESTRO Framework: Layering Up Against MAS Security Threats 44:05

۴ روز پیش44:05

44:05

Multi-Agent Systems (MAS), characterized by multiple autonomous agents coordinating to achieve shared goals, introduce additional complexity and expand the attack surface compared to single-agent systems. This episode delves into the unique security challenges presented by MAS, drawing on the OWASP Agentic Security Initiative's MAESTRO (Multi-Agent Environment, Security, Threat, Risk, and Outcome) framework. We explore how MAESTRO provides a layered and architectural methodology for structured threat modeling in MAS. The framework breaks down MAS security into seven distinct architectural layers, each with specific concerns, from the Foundation Model to the Agent Ecosystem. Crucially, we examine the cross-layer risks and emergent behaviors unique to MAS environments, highlighting how vulnerabilities don't just exist within layers but manifest through complex interactions between them. Furthermore, we discuss the key agentic factors—Non-Determinism, Autonomy, Agent Identity Management, and Agent-to-Agent Communication—that MAESTRO emphasizes as significantly contributing to these threat scenarios and amplifying risks across layers. Tune in to understand how applying MAESTRO helps uncover and mitigate these multifaceted security challenges in real-world MAS deployments, as detailed in the OWASP Multi-Agentic system Threat Modelling Guide. www.hackernoob.tips/navigating-the-labyrinth-structured-threat-modeling-in-multi-agent-systems-with-the-owasp-maestro-framework www.securitycareers.help/securing-the-autonomous-frontier-a-cisos-guide-to-protecting-multi-agent-systems-and-building-a-specialized-team…

1
Unmasking the Unseen: Building and Benefiting from Behavioral Threat Hunting 25:40

۶ روز پیش25:40

25:40

In today's complex threat landscape, adversaries are constantly evolving their tactics to evade traditional defenses. Behavioral threat hunting offers a proactive methodology to identify cyber threats that have infiltrated systems undetected and disrupt them before they cause significant damage, ultimately reducing attacker "dwell time". This episode delves into the fundamental requirements for establishing effective threat hunting capabilities, covering the crucial technological prerequisites like achieving sufficient visibility and storage for deep data analysis, and the necessity of a robust analysis platform. We also explore the essential personnel prerequisites, highlighting the need for skilled staffing, diverse team knowledge, and specific technical and analytical skill sets, while acknowledging the persistent challenge of skills shortages. Beyond tech and talent, we discuss the importance of foundational elements like emulation and validation, adopting a formal methodology such as the Threat Hunting Cycle, and utilizing centralized management and metrics tools to ensure consistent, repeatable, and valuable hunts. Finally, we uncover how effective threat hunting integrates with and enhances broader security operations and incident response, by improving security posture, closing visibility gaps, developing new automated detection capabilities from discovered unknown threats, and providing crucial documentation and support for incident response engagements. Join us as we explore how proactive hunting transforms security operations from reactive defense to strategic resilience. www.securitycareers.help/unmasking-the-unseen-why-behavioral-threat-hunting-is-essential-for-modern-security-operations…

1
Beyond the Prompt: Navigating the Threats to AI Agents 22:57

۷ روز پیش22:57

22:57

AI agents, programs designed to autonomously collect data and take actions toward specific objectives using LLMs and external tools, are rapidly becoming widespread in applications from customer service to finance. While built on LLMs, they introduce new risks by integrating tools like APIs and databases, significantly expanding their attack surface to include classic software vulnerabilities like SQL injection, remote code execution, and broken access control, in addition to inherent LLM risks like prompt injection. Our sources demonstrate that these vulnerabilities are largely framework-agnostic, stemming from insecure designs and misconfigurations rather than flaws in frameworks like CrewAI or AutoGen. Given the autonomous nature and expanded capabilities of agents, the potential impact of compromises escalates from data leakage to infrastructure takeover. This episode dives into the complex threats targeting AI agents and highlights why a layered, defense-in-depth strategy is essential, combining safeguards like Prompt Hardening, Content Filtering, Tool Input Sanitization, Tool Vulnerability Scanning, and Code Executor Sandboxing, because no single mitigation is sufficient to address the diverse attack vectors. www.securitycareers.help/securing-the-autonomous-frontier-layered-defenses-for-ai-agent-deployments/ https://www.hackernoob.tips/exploring-the-attack-surface-our-guide-to-ai-agent-exploitation/ https://vibehack.dev/ https://devsecops.vibehack.dev…

1
Space Under Pressure: Geopolitical Threats and the Evolving Cosmos (2025) 27:41

۸ روز پیش27:41

27:41

Drawing on open-source information and eight years of collected data, the CSIS Aerospace Security Project's 2025 Space Threat Assessment explores the key developments in foreign counterspace weapons and the evolving security landscape in Earth orbit. This assessment highlights how space is becoming a more dangerous place and is increasingly woven into both peacetime and wartime activities. The report categorizes counterspace weapons into four main types: kinetic, non-kinetic, electronic, and cyber operations. While the past year saw few headline-grabbing kinetic tests, concerns persist, notably regarding Russia's pursuit of a nuclear anti-satellite capability designed to target satellites orbiting Earth, which the United States and international partners remain concerned about. www.myprivacy.blog/space-threats-and-the-unseen-impact-a-privacy-perspective-on-the-2025-assessment www.compliancehub.wiki/navigating-the-orbital-minefield-compliance-challenges-in-the-2025-space-threat-landscape/…

1
The Price of Protection: Budgeting for Essential Cyber Hygiene (CIS IG1) 14:26

۹ روز پیش14:26

14:26

This episode explores the costs associated with implementing essential cyber hygiene as outlined by the CIS Critical Security Controls Implementation Group 1 (IG1). We delve into the different approaches enterprises can take – utilizing on-premises tools, leveraging Cloud Service Providers (CSPs), or partnering with Managed Service Providers (MSPs). Drawing on the guide's research, we discuss the types of tools and policies needed for the 10 areas of cyber defense, explore budgeting considerations for different enterprise sizes, and highlight how IG1 Safeguards can provide significant protection against common threats for a relatively low cost. Learn how to make informed and prioritized decisions to secure your enterprise, whether through owned infrastructure, outsourced services, or a hybrid approach. www.securitycareers.help/the-price-of-protection-making-cis-ig1-cyber-hygiene-achievable-and-affordable https://baseline.compliancehub.wiki…

1
GTIG 2024 Zero-Days: Espionage, Enterprise, and the Shifting Landscape 13:16

10 روز پیش13:16

13:16

Join us as we dive into Google Threat Intelligence Group's (GTIG) comprehensive analysis of zero-day exploitation in 2024. Drawing directly from the latest research, this episode explores the 75 zero-day vulnerabilities tracked in the wild. While the overall number saw a slight decrease from 2023, the analysis reveals a steady upward trend over the past four years. Discover the significant shift towards targeting enterprise-focused technologies, which jumped to 44% of tracked zero-days in 2024, up from 37% in 2023. We examine why security and networking products have become high-value targets, making up over 60% of enterprise exploitation, and the implications for defenders. Learn about the continued targeting of end-user platforms like desktop operating systems, especially Microsoft Windows, which saw an increase in exploitation, contrasting with decreased exploitation observed in browsers and mobile devices. We also break down who is driving this exploitation, with espionage actors (government-backed and commercial surveillance vendors) leading the charge, accounting for over 50% of attributed vulnerabilities. Hear about the persistent activity of PRC-backed groups targeting security technologies and the notable rise of North Korean actors mixing espionage and financial motives. Finally, we touch on the most frequently exploited vulnerability types and what vendors and defenders can do to counter these evolving threats. This episode provides a detailed look into the complex and changing world of zero-day exploitation in 2024, offering insights beyond just the numbers. breached.company/technical-brief-a-deep-dive-into-2024-zero-day-exploitation-trends…

1
Verizon DBIR 2025: Navigating Third-Party Risk and the Human Factor 12:11

11 روز پیش12:11

12:11

Join us as we unpack the critical insights from the Verizon 2025 Data Breach Investigations Report. This episode dives deep into the report's most prominent themes, highlighting the ever-increasing involvement of third parties in data breaches and the persistent influence of the human element, which was involved in 60% of breaches this year. We explore the prevalent incident patterns including System Intrusion, often involving ransomware, Basic Web Application Attacks, largely driven by stolen credentials, and Social Engineering, where phishing and pretexting remain key techniques, now joined by emerging threats like prompt bombing. Drawing on data collected from November 1, 2023, to October 31, 2024, we discuss how attackers exploit vulnerabilities, how different industries and organizations of all sizes are targeted, and the importance of frameworks like VERIS for understanding the threat landscape. Tune in to gain actionable insights directly supported by the data and analysis from the DBIR sources. breached.company/navigating-the-modern-threat-landscape-key-insights-from-the-verizon-dbir-2025…

1
The State of EU Cybersecurity: Threats, Trends, and the Evolving Landscape 16:21

12 روز پیش16:21

16:21

Explore the complex and widespread cybersecurity threat landscape currently facing the European Union. This episode delves into the findings of recent reports, highlighting how geopolitical tensions and the rapid pace of digitisation are fueling a surge in malicious cyber activity. We discuss the substantial threat level assessed for the EU, meaning direct targeting and serious disruptions are realistic possibilities [previous turn]. You'll learn about the most reported attacks, including Denial-of-Service (DoS/DDoS/RDoS) and ransomware, and how threats against data are also prevalent. We break down the key threat actors – from financially motivated cybercriminals and well-funded state-nexus groups focused on espionage and disruption, to increasingly unpredictable hacktivists driven by geopolitical events. Discover how threats are evolving, including the shift in ransomware tactics, the rise of hacker-for-hire services, the use of AI in creating fake content and misinformation, and the persistent danger posed by the exploitation of unpatched vulnerabilities and sophisticated supply chain attacks. We also look at which sectors are most targeted, including public administration and transport, and peer into the future to understand how emerging technologies like AI and quantum computing will shape the threat landscape towards 2030. www.compliancehub.wiki/understanding-the-evolving-cybersecurity-threat-landscape-in-the-eu-an-in-depth-analysis-for-compliance/ https://gdpriso.com/ https://baseline.compliancehub.wiki/…

1
Integrating Incident Response: A NIST SP 800-61r3 Guide to Cyber Risk Management 16:55

13 روز پیش16:55

16:55

Incident response is a critical part of cybersecurity risk management and should be integrated across organizational operations. This episode explores the recommendations and considerations for incorporating cybersecurity incident response throughout an organization’s cybersecurity risk management activities, as described by the new NIST Special Publication (SP) 800-61 Revision 3. We'll discuss how NIST SP 800-61r3, a CSF 2.0 Community Profile, uses the NIST Cybersecurity Framework (CSF) 2.0 Functions to provide a common language and structure for these efforts. Learn how the Govern, Identify, and Protect functions support preparation activities, while the Detect, Respond, and Recover functions cover the incident response itself. We'll also highlight the crucial role of continuous improvement, feeding lessons learned back into the overall strategy. This guidance aims to help organizations prepare for incidents, reduce their number and impact, and improve the efficiency and effectiveness of detection, response, and recovery activities. This episode is intended for cybersecurity program leadership, cybersecurity personnel, and others responsible for handling cybersecurity incidents www.compliancehub.wiki/beyond-reaction-integrating-incident-response-into-your-cybersecurity-risk-management-strategy-with-nist-sp-800-61r3 https://irmaturityassessment.com https://cyberinsurancecalc.com…

1
Beyond the Blueprint: Learning Cyber Resilience Together 20:26

14 روز پیش20:26

20:26

Achieving cyber resilience is a complex and dynamic journey with no one-size-fits-all solution. This episode explores how organizations can significantly improve their cyber resilience posture by leveraging the shared experiences, insights, and front-line practices of their peers and the wider ecosystem. Drawing on insights from the Cyber Resilience Compass initiative, we discuss why sharing what works in practice is essential for building collective knowledge in the field. You'll hear how participating in consultations and workshops, engaging in information-sharing networks like ISACs and CERTs, collaborating with external parties, and learning from real-world case studies can provide vital inspiration and direction. Discover how this collaborative approach helps organizations identify effective strategies, shape their resilience roadmaps, make well-informed decisions, and transition towards a more consistent and future-ready approach, ultimately enhancing the resilience of the entire ecosystem. breached.company/navigating-the-digital-storm-why-shared-experiences-are-your-compass-to-cyber-resilience…

1
EDPB 2024: Guarding EU Data Privacy in a Rapidly Changing Digital World 15:35

15 روز پیش15:35

15:35

Join us as we delve into the European Data Protection Board's (EDPB) 2024 Annual Report to understand how they championed data protection in a year marked by significant technological and regulatory shifts. This episode will cover the key milestones and priorities outlined in the EDPB's 2024-2027 Strategy, designed to strengthen, modernise, and harmonise data protection across Europe www.compliancehub.wiki/edpb-2024-navigating-the-complexities-of-data-protection-in-a-rapidly-evolving-digital-landscape…

به Player FM خوش آمدید!

Player FM در سراسر وب را برای یافتن پادکست های با کیفیت اسکن می کند تا همین الان لذت ببرید. این بهترین برنامه ی پادکست است که در اندروید، آیفون و وب کار می کند. ثبت نام کنید تا اشتراک های شما در بین دستگاه های مختلف همگام سازی شود.

به بیش از 500 موضوع گوش کنید

BIODANCE Bio-Collagen Real Deep Mask, Hydrating Overnight Hydrogel Mask, Pore Minimizing, Elasticity Improvement, 34g x4ea

Amazon eGift Card - Amazon Logo (Animated)

Nacome Solar Garden Outdoor Statues Turtle with Succulent and 7 LED Lights - Lawn Decor Tortoise Statue for Patio, Balcony, Yard Ornament - Unique Housewarming Gifts

پادکست هایی که ارزش شنیدن دارند

CISO Insights: Voices in Cybersecurity « » Coordinated Cyber Defense: Inside Vulnerability Disclosure Programs (VDP)

Coordinated Cyber Defense: Inside Vulnerability Disclosure Programs (VDP)

پادکست هایی که ارزش شنیدن دارند

به Player FM خوش آمدید!

Bounty Quick Size Paper Towels, White, 8 Family Rolls = 20 Regular Rolls (Packaging May Vary)

Ailun 3 Pack Screen Protector for iPhone 16 Pro Max [6.9 inch] + 3 Pack Camera Lens Protector with Installation Frame,Sensor Protection,Dynamic Island Compatible,Case Friendly Tempered Glass Film

TERRO Ant Killer Bait Stations T300B - Liquid Bait to Eliminate Ants - 12 Count Stations for Effective Indoor Ant Control

Peacock TV

Mom, I Want to Hear Your Story: A Mother’s Guided Journal To Share Her Life & Her Love (Hear Your Story Books)

راهنمای مرجع سریع

CISO Insights: Voices in Cybersecurity « »
Coordinated Cyber Defense: Inside Vulnerability Disclosure Programs (VDP)