WEBVTT

1
00:00:00.160 --> 00:00:03.200
<v Speaker 1>Welcome to our deep dive into security intelligence.

2
00:00:03.359 --> 00:00:05.320
<v Speaker 2>Ooh interesting, we're going to be taking.

3
00:00:05.120 --> 00:00:09.039
<v Speaker 1>A look at security intelligence. It's a book by King

4
00:00:09.199 --> 00:00:13.919
<v Speaker 1>Lye and Gregory Clark. They're really big names in cybersecurity.

5
00:00:14.080 --> 00:00:15.000
<v Speaker 2>Yeah, I mean King.

6
00:00:14.919 --> 00:00:19.079
<v Speaker 1>Lai holds seventeen US patents wow, and he's a globally

7
00:00:19.160 --> 00:00:23.079
<v Speaker 1>recognized speaker. He speaks on tech innovation. And then there's

8
00:00:23.120 --> 00:00:27.320
<v Speaker 1>Gregory Clark, and he brings leadership experience as CEO of

9
00:00:27.440 --> 00:00:28.440
<v Speaker 1>blee Coat Systems.

10
00:00:28.640 --> 00:00:29.160
<v Speaker 2>Oh wow.

11
00:00:29.359 --> 00:00:32.600
<v Speaker 1>Yeah, they develop cutting edge enterprise security products.

12
00:00:32.679 --> 00:00:33.159
<v Speaker 2>I see.

13
00:00:33.880 --> 00:00:36.479
<v Speaker 1>What's so interesting about this book is that it doesn't

14
00:00:36.520 --> 00:00:38.439
<v Speaker 1>just tell you what to do, it tells you why.

15
00:00:38.280 --> 00:00:39.880
<v Speaker 2>You have to do it. Oh that's cool.

16
00:00:40.079 --> 00:00:40.399
<v Speaker 1>Yeah.

17
00:00:40.439 --> 00:00:43.159
<v Speaker 2>So it really gets into the how and the why

18
00:00:43.280 --> 00:00:48.119
<v Speaker 2>exactly of modern security threats. So everything from malware to

19
00:00:48.640 --> 00:00:49.359
<v Speaker 2>data breaches.

20
00:00:49.600 --> 00:00:52.920
<v Speaker 1>Yeah, and it goes way beyond firewalls. I mean, this

21
00:00:52.960 --> 00:00:58.039
<v Speaker 1>book takes you deep into the evolving security landscape. One

22
00:00:58.039 --> 00:00:59.960
<v Speaker 1>of the things that really struck me about the book,

23
00:01:00.079 --> 00:01:03.960
<v Speaker 1>oh yeah, was how it describes the evolution of cyber attacks.

24
00:01:04.519 --> 00:01:07.560
<v Speaker 1>You know, it used to be this push approach where

25
00:01:07.760 --> 00:01:13.239
<v Speaker 1>hackers are aggressively trying to exploit vulnerabilities, but it shifted

26
00:01:13.280 --> 00:01:14.599
<v Speaker 1>to a pull approach.

27
00:01:15.400 --> 00:01:15.879
<v Speaker 2>Interesting.

28
00:01:15.959 --> 00:01:19.159
<v Speaker 1>Now, can you explain what that means for somebody like

29
00:01:19.239 --> 00:01:21.799
<v Speaker 1>me who's just trying to stay safe online.

30
00:01:21.840 --> 00:01:25.760
<v Speaker 2>Well, imagine this, Instead of like breaking down your door, okay,

31
00:01:26.120 --> 00:01:29.120
<v Speaker 2>cyber criminals are now leaving this like delicious looking cake

32
00:01:29.120 --> 00:01:32.319
<v Speaker 2>outside okay, hoping you'll be tempted to take a bite.

33
00:01:32.439 --> 00:01:33.200
<v Speaker 1>Oh I see.

34
00:01:33.599 --> 00:01:39.439
<v Speaker 2>So this pull approach is all about tricking users into

35
00:01:39.519 --> 00:01:42.840
<v Speaker 2>compromising their own security. Oh wow. So clicking on a

36
00:01:42.879 --> 00:01:47.439
<v Speaker 2>malicious link, downloading a bad file, or visiting a website

37
00:01:47.439 --> 00:01:51.879
<v Speaker 2>that's riddled with malware. It's all how we unknowingly open

38
00:01:51.920 --> 00:01:53.000
<v Speaker 2>the door to attackers.

39
00:01:53.159 --> 00:01:57.159
<v Speaker 1>The book gives some real world examples the Titan Rain

40
00:01:57.280 --> 00:02:03.079
<v Speaker 1>attacks on the US government stucks net, which targeted Iran's

41
00:02:03.359 --> 00:02:04.519
<v Speaker 1>nuclear program.

42
00:02:04.560 --> 00:02:08.479
<v Speaker 2>Those are some prime examples of how cyber warfare and

43
00:02:08.759 --> 00:02:11.199
<v Speaker 2>espionage are playing out in the real world.

44
00:02:11.280 --> 00:02:16.439
<v Speaker 1>And it shows that even highly secure organizations can be

45
00:02:16.560 --> 00:02:19.319
<v Speaker 1>vulnerable to sophisticated attacks.

46
00:02:19.479 --> 00:02:23.159
<v Speaker 2>And it shows why firewalls, while they're important, are no

47
00:02:23.280 --> 00:02:28.039
<v Speaker 2>longer enough. They're great at filtering basic traffic, but they

48
00:02:28.080 --> 00:02:32.159
<v Speaker 2>struggle with encrypted traffic. I see. And attackers who constantly

49
00:02:32.199 --> 00:02:37.240
<v Speaker 2>change tactics oh wow. And attacks that target applications we

50
00:02:37.360 --> 00:02:38.039
<v Speaker 2>use every day.

51
00:02:38.120 --> 00:02:41.960
<v Speaker 1>So that brings us to malware and malware delivery networks

52
00:02:42.039 --> 00:02:45.120
<v Speaker 1>or mDNS. So can you tell us more about these

53
00:02:45.240 --> 00:02:46.240
<v Speaker 1>lurers and traps.

54
00:02:46.280 --> 00:02:51.240
<v Speaker 2>Well, malware creators have become masters of deception. Really yeah,

55
00:02:51.439 --> 00:02:55.639
<v Speaker 2>they use social engineering techniques interesting to trick us. Oh wow,

56
00:02:55.759 --> 00:02:59.400
<v Speaker 2>Fakespear fishing for example, it's a highly targeted email attack.

57
00:03:00.000 --> 00:03:04.680
<v Speaker 1>Designed to trick you into revealing information or downloading malware.

58
00:03:04.800 --> 00:03:05.240
<v Speaker 2>Okay.

59
00:03:05.439 --> 00:03:09.240
<v Speaker 1>These emails often appear to come from a trusted source

60
00:03:09.520 --> 00:03:13.680
<v Speaker 1>like your bank exactly or a colleague, making them very convincing.

61
00:03:13.800 --> 00:03:14.159
<v Speaker 2>I see.

62
00:03:14.319 --> 00:03:18.479
<v Speaker 1>And then there's farming okay, where attackers redirect you to

63
00:03:18.879 --> 00:03:23.960
<v Speaker 1>fake websites. Oh wow, that look almost identical to legitimate one.

64
00:03:23.840 --> 00:03:25.919
<v Speaker 2>Like your online banking portal exactly.

65
00:03:26.400 --> 00:03:30.759
<v Speaker 1>Those sites are designed to steal your login credentials and

66
00:03:30.879 --> 00:03:32.120
<v Speaker 1>other sensitive information.

67
00:03:33.280 --> 00:03:37.280
<v Speaker 2>So even if our firewall is strong, they're finding ways

68
00:03:37.280 --> 00:03:40.840
<v Speaker 2>to bypass it by targeting us the human element.

69
00:03:41.000 --> 00:03:41.680
<v Speaker 1>Absolutely.

70
00:03:41.800 --> 00:03:43.639
<v Speaker 2>I found that both clever and terrifying.

71
00:03:43.719 --> 00:03:45.000
<v Speaker 1>And it's not just fishing and farming.

72
00:03:45.360 --> 00:03:45.840
<v Speaker 2>There's more.

73
00:03:45.919 --> 00:03:51.719
<v Speaker 1>There's compromised websites okay, where attackers inject malicious code. I see,

74
00:03:51.759 --> 00:03:55.919
<v Speaker 1>and that can also spread malware. Wow, there's search engine poisoning.

75
00:03:56.439 --> 00:03:56.879
<v Speaker 2>What's that?

76
00:03:57.000 --> 00:03:58.960
<v Speaker 1>Attackers manipulate search results?

77
00:03:59.120 --> 00:04:02.919
<v Speaker 2>Oh, to make malicious sites appear higher. Oh wow in

78
00:04:03.000 --> 00:04:03.599
<v Speaker 2>the rankings.

79
00:04:03.800 --> 00:04:06.360
<v Speaker 1>So you think you're going to a good site and

80
00:04:06.400 --> 00:04:09.360
<v Speaker 1>it's actually a bad one. So it's really a minefield

81
00:04:09.360 --> 00:04:13.800
<v Speaker 1>out there, it is. Then there's malvertizing, where ads themselves

82
00:04:13.840 --> 00:04:18.680
<v Speaker 1>are infected right with malware, and they spread it to

83
00:04:18.839 --> 00:04:20.120
<v Speaker 1>unsuspecting users.

84
00:04:21.079 --> 00:04:26.120
<v Speaker 2>These mDNS use sophisticated techniques, I bet, to hide their tracks.

85
00:04:26.480 --> 00:04:27.199
<v Speaker 1>Yeah.

86
00:04:27.480 --> 00:04:29.839
<v Speaker 2>The book mentions fast flux networks.

87
00:04:29.920 --> 00:04:32.240
<v Speaker 1>Fast flux networks, what are those?

88
00:04:32.639 --> 00:04:36.079
<v Speaker 2>It's like a malware server. Okay, that's constantly changing its

89
00:04:36.079 --> 00:04:39.319
<v Speaker 2>IP address? What making it really difficult to track down?

90
00:04:39.399 --> 00:04:42.319
<v Speaker 2>Oh wow, it's like trying to shoot a target. Yeah,

91
00:04:42.480 --> 00:04:44.759
<v Speaker 2>it's constantly moving and changing its appearance.

92
00:04:45.040 --> 00:04:48.079
<v Speaker 1>Okay, so the bad guys are upping their game. Yeah,

93
00:04:48.120 --> 00:04:52.920
<v Speaker 1>but what about our defenses? Can traditional anti virus software

94
00:04:53.120 --> 00:04:55.360
<v Speaker 1>keep up while these evolving threats?

95
00:04:55.399 --> 00:04:59.040
<v Speaker 2>Anti virus software still has a role in detecting and

96
00:04:59.079 --> 00:05:04.000
<v Speaker 2>blocking known threats, but it's facing an uphill battle. Really Yeah,

97
00:05:04.000 --> 00:05:07.360
<v Speaker 2>How so it's good at catching malware it's already been identified,

98
00:05:07.800 --> 00:05:11.360
<v Speaker 2>but it falls short against zero day exploits.

99
00:05:11.040 --> 00:05:12.279
<v Speaker 1>Zero day exploits.

100
00:05:12.920 --> 00:05:17.240
<v Speaker 2>What are those attacks that exploit vulnerabilities? Okay, that are

101
00:05:17.279 --> 00:05:20.839
<v Speaker 2>so new security researchers don't even know about them. Oh wow,

102
00:05:21.040 --> 00:05:24.319
<v Speaker 2>So we need smarter ways to detect these threats before

103
00:05:24.360 --> 00:05:25.240
<v Speaker 2>they can infect us.

104
00:05:25.399 --> 00:05:28.800
<v Speaker 1>So the book talks about some pretty fascinating it does

105
00:05:29.199 --> 00:05:33.279
<v Speaker 1>malnet detection techniques like URL reputation systems.

106
00:05:33.480 --> 00:05:38.839
<v Speaker 2>Right. These systems use machine learning to analyze URLs and

107
00:05:39.000 --> 00:05:43.639
<v Speaker 2>automatically flag them as either safe or potentially dangerous. No.

108
00:05:44.040 --> 00:05:44.560
<v Speaker 1>Interesting.

109
00:05:44.800 --> 00:05:48.800
<v Speaker 2>They look for suspicious characteristics like the length of the

110
00:05:48.920 --> 00:05:56.000
<v Speaker 2>domain name, unusual characters, other telltale signs that might indicate

111
00:05:56.199 --> 00:05:57.399
<v Speaker 2>a malicious website.

112
00:05:57.439 --> 00:05:59.399
<v Speaker 1>So it's like a credit score for websites, getting you

113
00:05:59.399 --> 00:06:01.639
<v Speaker 1>an idea of how trustworthy it is.

114
00:06:01.800 --> 00:06:02.279
<v Speaker 2>That's right.

115
00:06:02.360 --> 00:06:04.000
<v Speaker 1>What other techniques are out there?

116
00:06:04.120 --> 00:06:08.199
<v Speaker 2>Well, there's web page content analysis okay, which goes beyond

117
00:06:08.279 --> 00:06:13.079
<v Speaker 2>just the URL. It actually looks at the website content itself. Wow,

118
00:06:13.399 --> 00:06:18.079
<v Speaker 2>looking for red flags. So keywords, images, even the structure

119
00:06:18.120 --> 00:06:20.720
<v Speaker 2>of the web page are analyzed to see if it's

120
00:06:20.720 --> 00:06:22.240
<v Speaker 2>potentially malicious.

121
00:06:22.399 --> 00:06:22.920
<v Speaker 1>I see.

122
00:06:23.079 --> 00:06:26.519
<v Speaker 2>This helps to identify sites that might be hosting malware

123
00:06:27.319 --> 00:06:30.040
<v Speaker 2>or phishing scams, other cyber threads.

124
00:06:30.120 --> 00:06:34.360
<v Speaker 1>So we're talking about a multi layered approach here to security,

125
00:06:34.759 --> 00:06:38.279
<v Speaker 1>analyzing not just the URL, but the content of the website.

126
00:06:38.319 --> 00:06:40.600
<v Speaker 1>That seems a lot more robust, it is. And then

127
00:06:40.600 --> 00:06:44.879
<v Speaker 1>there are honeypots, which are decoy systems set up to

128
00:06:44.920 --> 00:06:46.120
<v Speaker 1>attract attackers.

129
00:06:46.399 --> 00:06:46.959
<v Speaker 2>That's right.

130
00:06:47.000 --> 00:06:49.600
<v Speaker 1>It's like setting a trap, it is, and studying how

131
00:06:49.680 --> 00:06:51.680
<v Speaker 1>the attackers try to spring it.

132
00:06:51.759 --> 00:06:54.759
<v Speaker 2>Yeah, you get to analyze their methods exactly, learn how

133
00:06:54.759 --> 00:06:56.079
<v Speaker 2>to better defend against them.

134
00:06:56.199 --> 00:07:02.199
<v Speaker 1>So honey pots can mimic different types of systems like servers, databases,

135
00:07:02.720 --> 00:07:06.879
<v Speaker 1>or even entire networks. Right, and you're observing how attackers

136
00:07:06.879 --> 00:07:12.040
<v Speaker 1>interact with the honeypot to gain insight into their tactics, tools,

137
00:07:12.079 --> 00:07:12.639
<v Speaker 1>and motive.

138
00:07:12.759 --> 00:07:19.199
<v Speaker 2>This intelligence helps improve defenses, right and proactively block future attacks.

139
00:07:19.519 --> 00:07:23.000
<v Speaker 1>That's fascinating, it is. It sounds risky, it is, but

140
00:07:23.120 --> 00:07:26.279
<v Speaker 1>incredibly valuable for gathering intelligence.

141
00:07:26.600 --> 00:07:31.519
<v Speaker 2>Now, while honeypots lure attackers, honey clients, honey clients, Yeah,

142
00:07:31.600 --> 00:07:32.040
<v Speaker 2>what are.

143
00:07:31.959 --> 00:07:34.160
<v Speaker 1>Those, they take a more proactive approach.

144
00:07:34.360 --> 00:07:34.839
<v Speaker 2>Oh okay.

145
00:07:34.879 --> 00:07:40.360
<v Speaker 1>They're essentially simulated clients like web browsers or email programs

146
00:07:40.680 --> 00:07:43.639
<v Speaker 1>uh huh, that are designed to browse the web and

147
00:07:43.720 --> 00:07:45.879
<v Speaker 1>interact with potential threats.

148
00:07:45.920 --> 00:07:46.399
<v Speaker 2>Interesting.

149
00:07:46.639 --> 00:07:51.480
<v Speaker 1>By deploying honey clients, security professionals can identify malicious websites,

150
00:07:52.040 --> 00:07:56.160
<v Speaker 1>phishing campaigns, and other online attacks. So they're like digital

151
00:07:56.240 --> 00:07:58.079
<v Speaker 1>canaries in a coal mine.

152
00:07:58.160 --> 00:08:01.439
<v Speaker 2>That's a great way to put it, alerting to danger exactly.

153
00:08:02.079 --> 00:08:06.959
<v Speaker 2>So honey clients are a powerful tool. Yeah, but detection

154
00:08:07.160 --> 00:08:10.240
<v Speaker 2>is just one part. What about preventing threats in the

155
00:08:10.279 --> 00:08:12.720
<v Speaker 2>first place. Okay, that's where proxies come in.

156
00:08:12.959 --> 00:08:13.600
<v Speaker 1>Proxies.

157
00:08:13.839 --> 00:08:15.800
<v Speaker 2>Yeah, those security gatekeepers.

158
00:08:16.000 --> 00:08:19.600
<v Speaker 1>So proxies are more than just simple filters. They are

159
00:08:19.759 --> 00:08:24.319
<v Speaker 1>It's like having a security guard who understands what's inside

160
00:08:24.319 --> 00:08:26.279
<v Speaker 1>the packages exactly delivered.

161
00:08:26.480 --> 00:08:31.000
<v Speaker 2>Yeah, proxies can analyze and manipulate the traffic flowing through them,

162
00:08:31.160 --> 00:08:35.279
<v Speaker 2>I see. One of their most valuable capabilities is SSL interception.

163
00:08:35.519 --> 00:08:36.480
<v Speaker 1>SSL interception.

164
00:08:36.639 --> 00:08:39.840
<v Speaker 2>You see a lot of Internet traffic today is encrypted

165
00:08:40.159 --> 00:08:44.279
<v Speaker 2>using ssltls, which is great for privacy, but it also

166
00:08:44.320 --> 00:08:49.679
<v Speaker 2>allows threats to hide within those encrypted connections. SSL interception

167
00:08:49.720 --> 00:08:51.960
<v Speaker 2>allows proxies decryct that traffic.

168
00:08:52.039 --> 00:08:56.240
<v Speaker 1>So even if attackers are using encryptions hide, proxies can

169
00:08:56.279 --> 00:08:58.879
<v Speaker 1>still see what's going on. That's right, that's reassuring.

170
00:08:59.000 --> 00:09:00.799
<v Speaker 2>It adds another layer protection but.

171
00:09:00.879 --> 00:09:03.440
<v Speaker 1>SSL interception isn't without its challenges.

172
00:09:03.639 --> 00:09:04.000
<v Speaker 2>It's not.

173
00:09:04.080 --> 00:09:06.720
<v Speaker 1>I mean, attackers are always trying to find ways, always

174
00:09:06.799 --> 00:09:12.879
<v Speaker 1>to bypass security, and they've developed techniques like client certificate

175
00:09:12.919 --> 00:09:16.600
<v Speaker 1>emulation and rogue certificate detection, Yeah.

176
00:09:16.320 --> 00:09:17.879
<v Speaker 2>To evade SSL interception.

177
00:09:18.039 --> 00:09:20.279
<v Speaker 1>It sounds like a constant cat and mouse game. It

178
00:09:20.360 --> 00:09:23.159
<v Speaker 1>is both sides trying to outsmart each other. So what

179
00:09:23.240 --> 00:09:24.320
<v Speaker 1>else can proxies do.

180
00:09:24.679 --> 00:09:32.720
<v Speaker 2>Will beyond SSL interception? Proxies can enforce very specific security policies. Oh,

181
00:09:33.080 --> 00:09:38.159
<v Speaker 2>they can control access based on user identity, application type,

182
00:09:38.600 --> 00:09:42.000
<v Speaker 2>content category, Wow, time of day, so many factors and

183
00:09:42.039 --> 00:09:43.559
<v Speaker 2>a whole host of other factors.

184
00:09:43.639 --> 00:09:45.480
<v Speaker 1>So it's a customizable bouncer.

185
00:09:45.200 --> 00:09:47.519
<v Speaker 2>Exactly for your network. That's a great way to put it.

186
00:09:47.440 --> 00:09:50.600
<v Speaker 1>Making sure only the right people get in. Speaking of

187
00:09:50.679 --> 00:09:55.919
<v Speaker 1>controlling access, the book really emphasizes it does understanding what

188
00:09:55.960 --> 00:09:57.720
<v Speaker 1>applications are running on your network.

189
00:09:57.799 --> 00:10:01.879
<v Speaker 2>Absolutely, knowing what applications are running is fundamental to security. Okay,

190
00:10:02.039 --> 00:10:06.519
<v Speaker 2>it allows you to enforce policies, prioritize traffic, make sure

191
00:10:06.519 --> 00:10:08.039
<v Speaker 2>your network is running efficiently.

192
00:10:08.240 --> 00:10:08.919
<v Speaker 1>That makes sense.

193
00:10:09.440 --> 00:10:13.559
<v Speaker 2>There are two main approaches to application classifications Okay, what

194
00:10:13.639 --> 00:10:17.519
<v Speaker 2>are they? Signature based and behavioral based? All right.

195
00:10:17.559 --> 00:10:18.759
<v Speaker 1>So signature based that.

196
00:10:18.720 --> 00:10:24.519
<v Speaker 2>It relies on pre defined patterns or signatures to identify applications.

197
00:10:23.879 --> 00:10:25.559
<v Speaker 1>Like a fingerprint database.

198
00:10:25.240 --> 00:10:26.799
<v Speaker 2>Exactly for applications.

199
00:10:26.919 --> 00:10:30.840
<v Speaker 1>But with so many applications out there, right, creating and

200
00:10:30.879 --> 00:10:35.559
<v Speaker 1>maintaining signatures for each one must be overwhelming, it can be.

201
00:10:36.120 --> 00:10:39.200
<v Speaker 1>So that's where behavioral based classification comes in.

202
00:10:39.320 --> 00:10:41.879
<v Speaker 2>It does how does that work? It analyzes network traffic

203
00:10:41.960 --> 00:10:45.840
<v Speaker 2>patterns like the size of data packets, the timing of

204
00:10:45.879 --> 00:10:48.879
<v Speaker 2>communications interested to identify applications.

205
00:10:49.440 --> 00:10:53.759
<v Speaker 1>So signature based is like checking ID while behavioral based

206
00:10:53.879 --> 00:10:55.360
<v Speaker 1>is observing behavior.

207
00:10:55.559 --> 00:10:56.919
<v Speaker 2>That's a good way to think about it, to.

208
00:10:56.960 --> 00:11:00.399
<v Speaker 1>Make an educated guess exactly. What about looking back in.

209
00:11:00.360 --> 00:11:02.399
<v Speaker 2>Time retrospective analysis?

210
00:11:03.279 --> 00:11:04.720
<v Speaker 1>Yeah, the book talked about that.

211
00:11:04.799 --> 00:11:09.840
<v Speaker 2>It's crucial for understanding what happened, okay, after a security incident.

212
00:11:10.000 --> 00:11:15.000
<v Speaker 2>I see uncovering how an attack unfolded, determining the extent

213
00:11:15.080 --> 00:11:16.039
<v Speaker 2>of the damage.

214
00:11:16.240 --> 00:11:19.720
<v Speaker 1>It's like forensic science. It is the digital world.

215
00:11:20.039 --> 00:11:25.919
<v Speaker 2>The key to effective retrospective analysis is having the right data, okay,

216
00:11:26.200 --> 00:11:31.159
<v Speaker 2>and that means collecting logs from various security devices and

217
00:11:31.399 --> 00:11:32.840
<v Speaker 2>capturing network traffic.

218
00:11:33.000 --> 00:11:37.600
<v Speaker 1>So it's like having security cameras throughout your network. Recording

219
00:11:37.679 --> 00:11:40.159
<v Speaker 1>everything that happens so you can review the footage if

220
00:11:40.200 --> 00:11:41.039
<v Speaker 1>something goes wrong.

221
00:11:41.240 --> 00:11:44.679
<v Speaker 2>That must generate a ton of data. It does, mountains

222
00:11:44.679 --> 00:11:47.399
<v Speaker 2>of data, wow, which is why data indexing is so important.

223
00:11:47.600 --> 00:11:52.639
<v Speaker 2>Data intexing techniques like b trees, bitmap indices allows security

224
00:11:52.639 --> 00:11:57.720
<v Speaker 2>professionals to search through those massive data sets quickly and efficiently.

225
00:11:57.879 --> 00:12:01.159
<v Speaker 1>It's like having a detailed index. It is for a

226
00:12:01.279 --> 00:12:05.399
<v Speaker 1>vast library, so you can find the exact info without

227
00:12:05.440 --> 00:12:06.480
<v Speaker 1>reading every book.

228
00:12:06.559 --> 00:12:09.519
<v Speaker 2>And with the volume of data generated by modern networks,

229
00:12:09.919 --> 00:12:11.080
<v Speaker 2>we're talking big data.

230
00:12:11.600 --> 00:12:12.120
<v Speaker 1>We are.

231
00:12:12.759 --> 00:12:15.840
<v Speaker 2>The book even talks about hadoop hadoop how it.

232
00:12:15.759 --> 00:12:17.759
<v Speaker 1>Can be used for security analysis.

233
00:12:17.799 --> 00:12:20.360
<v Speaker 2>The doop is a game changer for security. How so,

234
00:12:20.679 --> 00:12:25.639
<v Speaker 2>cridicial databases just weren't designed to handle that volume and

235
00:12:25.840 --> 00:12:28.679
<v Speaker 2>variety of data that modern networks generate.

236
00:12:29.039 --> 00:12:33.679
<v Speaker 1>So hadoop, with its distributed processing capability, allows you to

237
00:12:33.879 --> 00:12:39.679
<v Speaker 1>analyze massive data sets in parallel, making it faster, way faster.

238
00:12:39.480 --> 00:12:41.879
<v Speaker 2>And more efficient much more. That makes sense, it does,

239
00:12:42.039 --> 00:12:47.200
<v Speaker 2>especially when time is the essence. Absolutely, but the security

240
00:12:47.279 --> 00:12:50.399
<v Speaker 2>landscape is always changing, always, and one of the biggest

241
00:12:50.399 --> 00:12:52.840
<v Speaker 2>shifts has been mobile devices.

242
00:12:52.919 --> 00:12:56.320
<v Speaker 1>The explosion of mobile devices. The book dedicates a whole

243
00:12:56.320 --> 00:12:59.039
<v Speaker 1>section it does to mobile security challenges.

244
00:12:59.279 --> 00:13:01.480
<v Speaker 2>Right, It's something we can all relate to. It is

245
00:13:01.519 --> 00:13:04.879
<v Speaker 2>carrying around these powerful mini computers in our pockets all

246
00:13:04.919 --> 00:13:05.320
<v Speaker 2>the time.

247
00:13:05.440 --> 00:13:09.919
<v Speaker 1>The rise of mobile devices has introduced a whole new

248
00:13:10.000 --> 00:13:13.000
<v Speaker 1>set of security concerns it has. One of the biggest

249
00:13:13.399 --> 00:13:16.679
<v Speaker 1>is the blurring of boundaries, Oh interesting, between personal and

250
00:13:16.720 --> 00:13:17.480
<v Speaker 1>corporate data.

251
00:13:17.639 --> 00:13:22.440
<v Speaker 2>The BYOD trend bring your own device has made it

252
00:13:22.480 --> 00:13:26.840
<v Speaker 2>difficult to enforce security I see without infringing on user privacy.

253
00:13:26.960 --> 00:13:29.360
<v Speaker 1>So striking that balance is tricky.

254
00:13:29.639 --> 00:13:31.360
<v Speaker 2>It's a challenge for organizations.

255
00:13:31.480 --> 00:13:34.519
<v Speaker 1>It is you don't want to be too intrusive, but

256
00:13:34.759 --> 00:13:38.000
<v Speaker 1>you need to protect sensitive data exactly. And it's not

257
00:13:38.080 --> 00:13:42.120
<v Speaker 1>just about managing the devices themselves. It's also about the

258
00:13:42.159 --> 00:13:44.000
<v Speaker 1>applications they run.

259
00:13:44.120 --> 00:13:48.879
<v Speaker 2>The book highlights he does the security risks associated with

260
00:13:48.919 --> 00:13:49.879
<v Speaker 2>mobile app stores.

261
00:13:50.039 --> 00:13:54.080
<v Speaker 1>Mobile app stores can be dangerous.

262
00:13:54.399 --> 00:13:57.799
<v Speaker 2>They can. How so, what's some malicious appens slip through

263
00:13:57.840 --> 00:13:58.639
<v Speaker 2>the screening process?

264
00:13:58.720 --> 00:13:59.279
<v Speaker 1>Oh wow?

265
00:13:59.559 --> 00:14:03.840
<v Speaker 2>Others are legitimate apps, right that have been repackaged with malware.

266
00:14:04.000 --> 00:14:07.720
<v Speaker 2>Oh no, So it's crucial to be cautious. It is

267
00:14:07.840 --> 00:14:09.039
<v Speaker 2>about the apps you download.

268
00:14:09.120 --> 00:14:11.759
<v Speaker 1>So even if you trust the app store, right, you

269
00:14:11.799 --> 00:14:15.519
<v Speaker 1>can't trust every app on it exactly. What other mobile

270
00:14:15.559 --> 00:14:17.759
<v Speaker 1>security concerns did the.

271
00:14:17.799 --> 00:14:22.440
<v Speaker 2>Book address epns? Epns Yeah, while useful for public Wi fi,

272
00:14:23.120 --> 00:14:26.399
<v Speaker 2>have limitations when it comes to mobile. Oh, they don't

273
00:14:26.399 --> 00:14:29.320
<v Speaker 2>address all the attack vectors I see. The book suggests

274
00:14:29.360 --> 00:14:34.840
<v Speaker 2>a network centric approach, okay, focusing on controlling access all

275
00:14:34.919 --> 00:14:39.960
<v Speaker 2>right to corporate resources and monitoring traffic from mobile devices.

276
00:14:40.039 --> 00:14:43.320
<v Speaker 1>So instead of securing the device itself right, which can

277
00:14:43.360 --> 00:14:46.519
<v Speaker 1>be tricky with buyod yeah, you focus on securing the

278
00:14:46.559 --> 00:14:49.960
<v Speaker 1>network exactly. That seems more practical. It can be, But

279
00:14:50.080 --> 00:14:55.519
<v Speaker 1>as networks become more complex and more devices connect, understanding

280
00:14:55.519 --> 00:14:59.159
<v Speaker 1>what's running on them is becoming more important. The book

281
00:14:59.200 --> 00:15:03.759
<v Speaker 1>touched on it is application classification and network visibility.

282
00:15:03.919 --> 00:15:10.440
<v Speaker 2>Network visibility is essential for security and efficiency. It's about

283
00:15:10.480 --> 00:15:15.200
<v Speaker 2>knowing what devices are connected, what apps are running, what

284
00:15:15.320 --> 00:15:16.600
<v Speaker 2>data is being transmitted.

285
00:15:16.720 --> 00:15:19.679
<v Speaker 1>It's like trying to manage a city in the dark.

286
00:15:20.200 --> 00:15:21.360
<v Speaker 2>That's a great analogy.

287
00:15:21.519 --> 00:15:25.120
<v Speaker 1>You need that visibility you do to identify threats and

288
00:15:25.200 --> 00:15:26.480
<v Speaker 1>make informed decisions.

289
00:15:26.559 --> 00:15:32.360
<v Speaker 2>Earlier, we talked about signature based and behavioral based application classification.

290
00:15:32.480 --> 00:15:35.480
<v Speaker 1>Can you elaborate on how those work.

291
00:15:35.559 --> 00:15:39.399
<v Speaker 2>In the real world. Signature based is like using a

292
00:15:39.440 --> 00:15:45.600
<v Speaker 2>fingerprint database to identify known applications. It relies on pre

293
00:15:45.679 --> 00:15:51.200
<v Speaker 2>defined patterns or signatures that uniquely identify specific acts.

294
00:15:50.919 --> 00:15:52.320
<v Speaker 1>So it's quick and efficient.

295
00:15:52.720 --> 00:15:55.240
<v Speaker 2>It is for well known application, but it struggles with

296
00:15:55.440 --> 00:15:58.360
<v Speaker 2>newer applications or those that have been modified.

297
00:15:58.360 --> 00:16:01.519
<v Speaker 1>So it's good for the usual suspects. You could say that,

298
00:16:01.759 --> 00:16:03.440
<v Speaker 1>what about the unusual apps?

299
00:16:03.799 --> 00:16:08.600
<v Speaker 2>Behavioral based classification is more adaptable. Oh okay. It analyzes

300
00:16:08.639 --> 00:16:13.039
<v Speaker 2>traffic characteristics to classify applications based on their.

301
00:16:12.879 --> 00:16:15.759
<v Speaker 1>Behavior, even if they haven't been seen before. Exactly how

302
00:16:15.759 --> 00:16:16.399
<v Speaker 1>does it do that?

303
00:16:16.519 --> 00:16:19.759
<v Speaker 2>It looks at things like packet size, of timing, and

304
00:16:19.759 --> 00:16:21.399
<v Speaker 2>communication pattern to make.

305
00:16:21.240 --> 00:16:25.080
<v Speaker 1>An educated guess about what the application is doing.

306
00:16:25.240 --> 00:16:27.480
<v Speaker 2>That sounds like it could be prone to errors. It

307
00:16:27.519 --> 00:16:32.120
<v Speaker 2>can be, but as machine learning gets better, behavioral based

308
00:16:32.200 --> 00:16:33.960
<v Speaker 2>classification is becoming more accurate.

309
00:16:34.159 --> 00:16:37.240
<v Speaker 1>Security isn't just about technology, though, you're right. The book

310
00:16:37.440 --> 00:16:42.120
<v Speaker 1>also emphasized that the human element absolutely and the importance

311
00:16:42.240 --> 00:16:43.679
<v Speaker 1>of data loss prevention.

312
00:16:44.200 --> 00:16:48.039
<v Speaker 2>Technology alone can't solve every problem. That's right, We need

313
00:16:48.039 --> 00:16:49.480
<v Speaker 2>to address the human element too.

314
00:16:49.720 --> 00:16:52.360
<v Speaker 1>So data loss prevention DLP.

315
00:16:52.399 --> 00:16:56.600
<v Speaker 2>What is that? It focuses on safeguarding information and preventing

316
00:16:56.600 --> 00:16:58.440
<v Speaker 2>it from leaving the organization, So.

317
00:16:58.440 --> 00:17:02.639
<v Speaker 1>Not just keeping external threats, but also making sure sensitive

318
00:17:02.639 --> 00:17:04.839
<v Speaker 1>information doesn't leak from within exactly.

319
00:17:05.400 --> 00:17:08.519
<v Speaker 2>So DLP solutions they use a bunch of different methods

320
00:17:09.000 --> 00:17:11.759
<v Speaker 2>to analyze content, identify sensitive.

321
00:17:11.440 --> 00:17:13.680
<v Speaker 1>Data things like credit card numbers.

322
00:17:13.519 --> 00:17:18.880
<v Speaker 2>Yes, or social security numbers. Then what and then enforced policies.

323
00:17:18.319 --> 00:17:19.920
<v Speaker 1>To prevent that data from leaving.

324
00:17:20.039 --> 00:17:25.759
<v Speaker 2>That's right. They can scan emails, attachments, web traffic files

325
00:17:25.799 --> 00:17:27.160
<v Speaker 2>stored on devices like.

326
00:17:27.079 --> 00:17:28.680
<v Speaker 1>A security guard for your data.

327
00:17:29.319 --> 00:17:31.359
<v Speaker 2>That's a good way to put it, always on the lookout.

328
00:17:31.440 --> 00:17:34.039
<v Speaker 2>That's crucial for meeting data privacy.

329
00:17:33.640 --> 00:17:36.960
<v Speaker 1>Regulations, regulations like GDPR.

330
00:17:37.039 --> 00:17:38.240
<v Speaker 2>YES and CCPA.

331
00:17:38.400 --> 00:17:41.000
<v Speaker 1>Companies are facing a lot of pressure they are to

332
00:17:41.079 --> 00:17:42.400
<v Speaker 1>protect personal.

333
00:17:42.039 --> 00:17:44.720
<v Speaker 2>Data and DLP is critical.

334
00:17:44.319 --> 00:17:45.759
<v Speaker 1>For meeting those requirements.

335
00:17:45.759 --> 00:17:48.880
<v Speaker 2>Failing to protect that data can lead to big fines

336
00:17:49.400 --> 00:17:50.559
<v Speaker 2>and damage your reputation.

337
00:17:50.759 --> 00:17:55.319
<v Speaker 1>So it seems like security intelligence really emphasizes this layered

338
00:17:55.400 --> 00:18:01.920
<v Speaker 1>approach to security, combining technology, user edge and data protection.

339
00:18:02.160 --> 00:18:02.759
<v Speaker 2>That's the key.

340
00:18:02.920 --> 00:18:05.440
<v Speaker 1>It's not about one single tool.

341
00:18:05.440 --> 00:18:05.799
<v Speaker 2>It's not.

342
00:18:06.039 --> 00:18:10.480
<v Speaker 1>It's creating a multifaceted defense exactly, one that can adapt

343
00:18:10.720 --> 00:18:11.880
<v Speaker 1>to the changing threats.

344
00:18:11.960 --> 00:18:13.599
<v Speaker 2>Think of it like building a castle.

345
00:18:13.920 --> 00:18:14.640
<v Speaker 1>Okay, I like.

346
00:18:14.599 --> 00:18:19.400
<v Speaker 2>It with multiple layers of walls, moats, guard towers. Wow,

347
00:18:19.519 --> 00:18:21.839
<v Speaker 2>you want to make it as difficult as possible, get

348
00:18:21.880 --> 00:18:24.440
<v Speaker 2>it in for attackers to breach your defenses.

349
00:18:24.480 --> 00:18:28.359
<v Speaker 1>And the book also talked about being proactive, absolutely constantly

350
00:18:28.440 --> 00:18:32.240
<v Speaker 1>monitoring for threats. You have to adapting security strategies.

351
00:18:32.319 --> 00:18:34.640
<v Speaker 2>Security is not a set it and forget it thing. Right,

352
00:18:34.799 --> 00:18:36.559
<v Speaker 2>The threats are always changing.

353
00:18:36.279 --> 00:18:38.319
<v Speaker 1>So we need to be vigilant, always.

354
00:18:38.079 --> 00:18:44.319
<v Speaker 2>Learning, adapting ahead, staying informed about new threats, patching vulnerabilities,

355
00:18:44.400 --> 00:18:45.960
<v Speaker 2>updating security policies.

356
00:18:46.000 --> 00:18:49.200
<v Speaker 1>It's a never ending race, it is, but no one

357
00:18:49.240 --> 00:18:52.039
<v Speaker 1>can do it alone, that's right. The book also talked

358
00:18:52.079 --> 00:18:57.200
<v Speaker 1>about collaboration. Information sharing so important in the fight against cybercrime.

359
00:18:57.359 --> 00:19:01.880
<v Speaker 2>It is sharing information about threats, vulnerabilities, best practices.

360
00:19:01.920 --> 00:19:03.119
<v Speaker 1>It benefits everyone.

361
00:19:03.200 --> 00:19:06.319
<v Speaker 2>The whole industry benefits from that knowledge, working together to

362
00:19:06.359 --> 00:19:08.359
<v Speaker 2>build a stronger cyber ecosystem.

363
00:19:08.519 --> 00:19:11.400
<v Speaker 1>The book mentioned events like the RSA Conference.

364
00:19:12.640 --> 00:19:17.759
<v Speaker 2>Those are vital for collaboration, bringing together security professionals, researchers,

365
00:19:18.359 --> 00:19:19.599
<v Speaker 2>industry leaders.

366
00:19:19.279 --> 00:19:22.960
<v Speaker 1>To discuss the latest threats, share insights, and to elaborate

367
00:19:23.359 --> 00:19:28.319
<v Speaker 1>on solutions. So security intelligence is more than a technical manual.

368
00:19:28.519 --> 00:19:30.759
<v Speaker 1>It is it's a call to action, right, to be

369
00:19:30.839 --> 00:19:35.359
<v Speaker 1>more aware, more engaged, more proactive in securing our digital lives.

370
00:19:35.400 --> 00:19:39.640
<v Speaker 1>Fawstering a culture of security where everyone understands.

371
00:19:39.079 --> 00:19:42.880
<v Speaker 2>Their role in protecting data and system, empowering.

372
00:19:42.440 --> 00:19:44.640
<v Speaker 1>Users to make smart decisions.

373
00:19:44.119 --> 00:19:46.240
<v Speaker 2>To report suspicious activity.

374
00:19:45.920 --> 00:19:48.440
<v Speaker 1>Follow security best practices.

375
00:19:47.920 --> 00:19:50.720
<v Speaker 2>Recognizing that security is everyone's responsibility.

376
00:19:50.799 --> 00:19:53.960
<v Speaker 1>Well, this deep dive has really been eye opening to

377
00:19:54.039 --> 00:19:57.920
<v Speaker 1>the complexity of security intelligence. It is complex and it's

378
00:19:58.000 --> 00:20:02.960
<v Speaker 1>always changing. I think this book is so valuable for

379
00:20:03.000 --> 00:20:05.079
<v Speaker 1>anyone who wants to be safe online.

380
00:20:05.279 --> 00:20:08.640
<v Speaker 2>Knowledge is power, that's right, and the more you understand

381
00:20:08.640 --> 00:20:11.559
<v Speaker 2>about the threats, yeah, the better you can protect yourself,

382
00:20:11.720 --> 00:20:13.359
<v Speaker 2>your data, your organization.

383
00:20:13.720 --> 00:20:19.440
<v Speaker 1>If you're looking for a comprehensive guide yeah to security intelligence.

384
00:20:18.799 --> 00:20:20.839
<v Speaker 2>I recommend this book pick up.

385
00:20:20.839 --> 00:20:24.759
<v Speaker 1>Security Intelligence King Lee and Gregory Clark. It's packed with

386
00:20:24.920 --> 00:20:28.400
<v Speaker 1>insights and practical advice that can help you stay ahead

387
00:20:28.400 --> 00:20:31.799
<v Speaker 1>of the curve. Absolutely, that brings us to the end

388
00:20:32.039 --> 00:20:33.359
<v Speaker 1>of our deep die.

389
00:20:33.279 --> 00:20:34.880
<v Speaker 2>Into security intelligence.

390
00:20:35.000 --> 00:20:37.920
<v Speaker 1>We hope you found it informative and insightful.

391
00:20:38.119 --> 00:20:40.680
<v Speaker 2>Until next time, stay safe out there

392
00:20:40.839 --> 00:20:42.559
<v Speaker 1>Keep exploring, keep learning.