#173 – Kaja Narum

Erik Zalitis — Sat, 11 Jun 2022 17:00:00 +0000

Kaja Narum i IT-säkerhetspodden.

Avsnittet: 173 – Kaja Narum
Inspelat: 2022-06-09 (publicerat 2022-06-12)
Deltagare: Mattias Jadesköld, Erik Zalitis och Kaja Narum.
Detta avsnitt är ett samarbete med Nordlo.

Lyssna på avsnittet – Kaja Narum

Medan du lyssnar – Kaja Narum

I dagens avsnitt av IT-säkerhetspodden har vi Kaja Narum med oss i studion, som jobbar på IBM i rollen Security Service leader i Norra Europa. Nyligen släppte hon och hennes kollegor Threat intelligence rapporten X-Force.

Denna identifierar de största hoten just nu. Det som kanske sticker i ögonen är det faktum att Kaja ser att Sveriges cyberförsvar har halkat efter vårt kära grannland. Så vad är det Norge gör rätt? Och hur kan vi i Sverige komma ikapp?

Som vanligt är det snabba ryck. Jag fick veta att hon var försenad på grund av flyget, vilket inte borde förvåna någon givet kaoset just nu. Så det blev en intervju via länk, men det har vi gjort förut och vi kunde få igång allting i tid och utan problem ändå.

Känslan är att Sverige och Norge har två helt olika sätt att tänka på cyberrisker. I Sverige sköter samma myndigheter sina uppgifter i kris- som i normal tid, medan Norge har ett nationellt cyberförsvar, vilket inte gäller oss. Men Kaja säger att hon känner till att vi är på väg att få en sådan organisation även här.

Så varför räcker det inte med att MSB och cert.se hanterar situationen, enligt henne. Lyssna på intervjun, så kommer det klarna.

Det är ett knepigt läge för hela Europa just nu och då är det helt klart en bra strategi att skapa ett bättre cyberförsvar för oss, medan Norge redan är där.

Länkar – Kaja Narum

Felaktigheter

Inget att rapportera denna gång. Kommentera gärna om ni ~~inte håller med om~~ hittar fel i något vi sagt.

Inlägget #173 – Kaja Narum dök först upp på IT-säkerhetspodden.

#170 – Sig Security about the practical use of Threat Intelligence

Erik Zalitis — Sun, 22 May 2022 16:00:01 +0000

The episode: 170 – Sig Security about the practical use of Threat Intelligence
Recorded: 2022-05-17 (publicerat 2022-05-22)
Participants: Erik Zalitis, Jesper Olsen and Christoffer Strömblad
This episode is made in cooperation with SIG Security.

Listen to the episode, now – Threat intelligence

While listening to this episode – Threat intelligence

English, again? Yes. I thought it would make it easier to pull together with two Swedes and a Danish. I talk about nationalities here, not food, just pointing that out. Anyways, we have a old friend, Christoffer Strömblad, who was in this podcast in 2019 and a new one, Jesper Olsen. Christoffer has since left the Swedish Police and joined TrueSec, a Swedish IT-security focused company.

Jesper is Danish and works for Palo Alto Network, a very welknown creator of security appliances.

IT-admin, know thyself!

The subject is interesting, and simple goes:

”If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.”

It used to be a bit suspicious with security people quoting Sun Tzu, as it was more bravado than actual product. But here, and in this warlike state of business that is the Internet, it fits very well. We are in the middle of a coevolution between hackers and defenders.

Christoffer and Jesper talks about what the properties of common victims are and have three rules to go by to assess the situation:

Archetypes – who gets attacked?
Vulnerabilities – How to they get attacked?
Recognizance – How to they find you?

This may seem like the same discussion like it always was, and yes, to a certain point it is. But it’s 2022 and the methods they describe are pretty new as in ”a new way of doing the same”. In the IT-security business, this counts. Brand new, never seen attacks are few. But new takes on old tricks, is what we see all the time as attackers try to remain in control. They crawl around our latest defences. Right now, TrueSec has seen an uptick in USB-drive attacks. Why? Listen to the podcast. It’s around 19 minutes into the show.

But don’t worry, we also got a new development for you:

Initial Access Brokers

At 20:57 I ask Jesper about IABs. That is hackers selling access to organizations instead of data. As the business of hacking matures, it gets more specialized as I wryly note. This is at least new for me and the big development is not how something appears for the first time. Rather when it becomes a thing. You can’t go full hipster and say ”I knew about that attackvector before everyone did! Dude, like they sold out!”.

Worse than the decease – the Therac 25

On or about 19:00 I mentiod an X-ray machine killing a patient. It was a device known as Therac-25 and had a bug that sometimes, very uncommonly delivered deadly doses of radiation. The software bug was eventually found, but it was nearly impossible to reproduce the conditions until you knew them. The device had multiple failsafe, but in the end, it did not matter. I’ll add a link in the bottom of this page, where you can read the story. But this qoute should scare you:

What they found was shocking. The software appeared to have been written by a programmer with little experience coding for real-time systems. There were few comments, and no proof that any timing analysis had been performed. According to AECL, a single programmer had written the software based upon the Therac-6 and 20 code. However, this programmer no longer worked for the company, and could not be found.

Links – Threat intelligence

Errors and omissions

Nothing to report at this time.

Inlägget #170 – Sig Security about the practical use of Threat Intelligence dök först upp på IT-säkerhetspodden.

Threat Intelligence-arkiv - IT-säkerhetspodden