The 85th episode of the Silver Bullet Security Podcast is a double whammy. Gary talks mobile security with two guests —Jim Routh, former global head of application security at JP Morgan Chase (and newly-appointed CSO), and Scott Matusmoto, Principal Consultant and head of the mobile security practice at Cigital. All three discuss the challenges of mobile security and how these challenges are exactly the same as and utterly different than software security concerns from across the years. They discuss use of new technologies including accelerometers in enhancing security (or compromising privacy), and the effect that massive phone rooting has on security. Is mobile security the same old same old or a brand new day? Listen to this podcast and find out for yourself.

• Trusted Computing and Computational Liberty
• John Steven on Mobile Security
• Securing Java (dancing pigs and native code risk)
• Exploiting Online Games
• Trusted on Busted

On the 84th episode of the Silver Bullet Security Podcast, Gary chats with W. Hord Tipton, Executive Director of (ISC)². Gary and Hord discuss how one gets into science and engineering when growing up in rural Tennessee, what insight being nuclear and chemical engineer gives Hord about modern control systems, whether or not certification can help advance software security, and the benefits of teaching software security to kids.

• (ISC)²
• (ISC)2 management team
• The World Is Flat 3.0: A Brief History of the Twenty-first Century by Thomas L. Friedman

On the 83rd episode of the Silver Bullet Security Podcast, Gary talks with Mark Graff, CISO at NASDAQ OMX. Gary and Mark discuss what exactly a CISO does all day, how corporate security posture at NASDAQ compares to the security posture at Lawrence Livermore National Laboratory, Enrico Fermi and the piano tuners (the “Fermi problem”) and how it relates to estimation, and the most surprising cultural difference between the left and right coasts. They close out their conversation with talk about Mark’s favorite poem from the mid-19th century (and yet it still has a software security connection!).

• NASDAQ OMX
• Lawrence Livermore National Laboratory
• Congressional testimopny (video)
• Secure Coding: Principles and Practices
• BSIMM
• Video from LLNL
• Fermi problem
• Cyber War and Active Defense
• Dover Beach (poem)

On the 82nd episode of the Silver Bullet Security Podcast, Gary talks with Kevin Fu, Associate Professor in the EECS Department at the University of Michigan. Gary and Kevin discuss finding advisors and picking a grad school, the security implications of embedded medical devices, malware in hospital systems, the consumer trend toward analyzing one’s own health data, and the difficulty of teaching design analysis to other humans. They close out the episode discussing lobster bisque.

• Kevin Fu and Grant Schoenebeck Join the Faculty of CSE @ Michigan
• The Bob and Betty Beyster Bubbler
• Medical Device Security Center blog
• Health-care sector vulnerable to hackers, researchers say, Washington Post.
• FDA Software Patch Poster
• Hugo Campos fights to get his defibrillator data

On the 81st episode of the Silver Bullet Security Podcast, Gary talks with Steve Bellovin, Professor of Computer Science at Columbia University, currently on leave and acting as CTO of the Federal Trade Commission. Gary and Steve discuss how often academic research finds its way into the real world versus research that’s done in a commercial lab, how code has gotten better overall but how the threat model has changed, whether mobile security is just a repackaging of the same security problem we’ve been dealing with for years, the state of computer security in the government, the very first days of Usenet and the famed Evil Bit.

• Steven M. Bellovin
• Firewalls and Internet Security: Repelling the Wily Hacker by William R. Cheswick, Steven M. Bellovin, and Aviel D. Rubin
• Encrypted Key Exchange
• Technology Transfer: A Software Security Marketplace Case Study (IEEE Software, September/October 2011) [PDF]
• TSA Pre
• Twitter and the FTC
• Usenet
• nn
• The Evil Bit RFC
• Permissive Action Link
• Steve drives a train

On the 80th episode of the Silver Bullet Security Podcast, Gary talks with Thomas Rid, Reader in War Studies at King’s College London and a non-resident fellow at the Center for Transatlantic Relations in the School for Advanced International Studies, Johns Hopkins University, in Washington, DC. In this episode, Gary and Thomas discuss how Thomas’ life as a “wandering academic” influences his work at the War Studies Department, the inevitably (or otherwise) of cyber-war, attribution, and military dictionaries and the problem of jargon. They close out their chat talking about the Barbican cultural center.

• Thomas Rid
• Cyber War Will Not Take Place
• Proactive defense prudent alternative to cyberwarfare, SearchSecurity.com.
• Barbican

On the 79th episode of the Silver Bullet Security Podcast, Gary talks with Per-Olof Persson (a.k.a. Peo), head of Global Software Security Operations at Sony Mobile and Board member of Sony Corporation. Gary and Per-Olof discuss the importance of working different positions within the same company, Sony Mobile’s software security initiative, the political concerns of software security, and the cultural challenges of working with international teams. They close out the show with a discussion of American Presidential politics.

• Transcript of this episode [PDF]
• Per-Olof on LinkedIn
• Sony Mobile
• BSIMM4

On the 78th episode of the Silver Bullet Security Podcast, Gary talks with Jacob West, Director, Software Security Research for the Enterprise Security Products division of Hewlett-Packard and newly minted CTO. Gary and Jacob discuss HP’s acquisition of Fortify, the technical trade-offs that have to be made to allow a tool become widely adopted, BSIMM4, and mobile security. They close out their discussion covering the impossibility of growing good tomatoes in San Francisco.

• BSIMM4
• Fortify acquired by HP
• MOPS
• On using data to drive a scientific model – Cargo Cult Computer Security (January 28, 2010)
• BSIMM Community
• Secure Programming with Static Analysis
• Dancing Pigs and Security
• Jacob and gem’s foodie adventures

On the 77th episode of the Silver Bullet Security Podcast, Gary talks with Gary Warzala, CISO of Visa International. The Garys discuss what a CISO’s day-to-day job looks like, how companies can attract and retain good security employees, whether consumers need to understand the difference between software security and security software, and how one can measure security and discuss the results with upper management.

• Congress should encourage bug fixes, reward secure systems
• Verizon 2012 Data Breach Investigations Report [PDF]
• The Debt Bomb

On the 76th episode of the Silver Bullet Security Podcast, Gary chats with David Evans, Associate Professor of Computer Science at the University of Virginia. Gary and Dave discuss the founding of the Interdisciplinary Major in Computer Science (BA) at UVa and why a broad approach to Computer Science and Computer Security is a good idea, why data privacy gets short shrift in the United States, why people think (for no apparent reason) that their mobile devices are secure, groceries, David’s research on Secure Computation, and the Udacity project. They close out their discussion with a story about David’s trip to the World Cup in Korea and a choice between GEB and scheme.

• David Evans
• Jefferson’s Wheel, David’s blog
• Interdisciplinary Major in Computer Science
• Udacity
• Research Without Walls
• GEB
• Scheme
• World Cup Korea

On the landmark 75th episode of Silver Bullet, Gary talks with Howard Schmidt, former Cybersecurity Coordinator for the Obama administration. In this episode, Gary and Howard discuss the differences between doing security work in the public and private sectors, the difficulties of establishing cybersecurity in the government (especially when it comes to software security), the government’s involvement in cyberespionage, and how the actions of Anonymous and Wikileaks square with the notion of free speech. They close the episode out with talk about Harleys.

This special edition of Silver Bullet was also captured on video. View the video below (for those on feed readers, go to this episode’s page for the video):

• Howard Schmidt (Wikipedia)
• U.S. cybersecurity chief Howard Schmidt retiring
• White House cyber security coordinator Howard Schmidt joins Qualys

On the 74th episode of The Silver Bullet Security Podcast, Gary talks for a second time with Bruce Schneier. They revisit Bruce’s prediction in episode 9 that insight into economics and security would help vendors sell their products more efficiently. In addition, they discuss Bruce’s new book Liars and Outliers: Enabling the Trust that Society Needs to Thrive, how far behind the government is in terms of security, cloud computing, and Uncle Milton’s ant farm.

• Bruce Schneier
• Applied Cryptography
• Liars and Outliers
• Silver Bullet Security Podcast, show 009 (December 2006) – Gary’s first chat with Bruce Schneier
• US cyber czar Howard Schmidt resigns
• Workshop on Economics and Information Security
• Separating the Threat from the Hype: What Washington Needs to Know About Cyber Security in AMERICA’S CYBER FUTURE: SECURITY AND PROSPERITY IN THE INFORMATION AGE VOLUMES I AND II, Center for a New Amercian Security (June 2011).
• Prisoner’s Dilemma (Axelrod)
• Uncle Milton’s Ant Farm
• The Ugly Sweater Store
• Vintage Spirits and Forgotten Cocktails: From the Alamagoozlum to the Zombie 100 Rediscovered Recipes and the Stories Behind Them – Mixology

On the 73rd episode of The Silver Bullet Security Podcast, Gary talks with Robert Vamosi, senior analyst with Mocana, freelance security reporter, and author of When Gadgets Betray Us. Gary and Robert discuss whether we’re doomed to idiocy as a species thanks to gadget dependency, why designers ignore security and privacy issues in gadget design. Finally, Gary and Robert discuss Robert’s use of the word “betray.”

• Robert Vamosi
• Robert Vamosi (at Mocana)
• When Gadgets Betray Us
• Gary on Stuxnet
• With Or Without You

On the 72nd episode of The Silver Bullet Security Podcast, Gary talks with Randy Sabett, a lawyer with the ZwillGen cyber-law firm in Washington, DC. Gary and Randy discuss Microsoft’s Zeus Botnet raid, alleged AT&T/NSA wiretapping, whether cyberlaw is full of loopholes, and if security always trades off against privacy and anonymity. They close out their discussion discussing the book Randy is currently reading.

• Randy V. Sabett
• Microsoft and Financial Services Industry Leaders Target Cybercriminal Operations from Zeus Botnets, The Official Microsoft Blog.
• Microsoft Raids Tackle Internet Crime, The New York Times.
• Court Upholds 5th Amendment-based Refusal to Decrypt Hard Drive
• Separating the Threat from the Hype: What Washington Needs to Know About Cyber Security in AMERICA’S CYBER FUTURE: SECURITY AND PROSPERITY IN THE INFORMATION AGE VOLUMES I AND II, Center for a New Amercian Security (June 2011).
• The Cuckoo’s Egg by Clifford Stoll
• Fram oil filter commercial
• Is time running out on the billable hour?
• The Singularity is Near by Ray Kurzweil

On the 71st episode of The Silver Bullet Security Podcast, Gary talks with Bill Arbaugh, Associate Professor of Computer Science at University of Maryland. Gary and Bill discuss how malware has evolved and changed over the last decade and how it’s affected software security practices, BIOS-based attacks, academia vs. startup, and why the NSA doesn’t play defense when it comes to cybersecurity.

• Bill Arbaugh @ UMD
• Microsoft Acquires Komoku
• Silver Bullet: Ross Anderson, show 13, show 70
• International Capture the Flag
• Separating the Threat from the Hype: What Washington Needs to Know About Cyber Security in AMERICA’S CYBER FUTURE: SECURITY AND PROSPERITY IN THE INFORMATION AGE VOLUMES I AND II, Center for a New Amercian Security (June 2011).

The 70th episode of The Silver Bullet Security Podcast is our first repeat performance. Gary chats a second time with Ross Anderson, Professor of Security Engineering at the Computer Laboratory at Cambridge University and author of the book Security Engineering. Ross was a guest on episode 13 of The Silver Bullet Security Podcast and is our first return guest. Gary and Ross discuss the latest developments in Trusted Computing, the iterated “Prisoner’s Dilemma” as an economic model and its relevance to computer security, information compartmentalization and Wikileaks, time and security, cyberwar versus cybercrime, and Stuxnet.

• Silver Bullet Show 013: Ross Anderson
• Transcript of episode 13 [PDF]
• Ross Anderson
• Trusted Computing FAQ
• Security Engineering – Ross’ groundbreaking book in print and online
• Separating the Threat from the Hype: What Washington Needs to Know About Cyber Security in AMERICA’S CYBER FUTURE: SECURITY AND PROSPERITY IN THE INFORMATION AGE VOLUMES I AND II, Center for a New Amercian Security (June 2011).

On the 69th episode of The Silver Bullet Security Podcast, Gary talks with Steve Myers, Assistant Professor of Informatics and Computing in the School of Informatics at Indiana University and a member of the Center for Applied Cybersecurity. During this show, Gary and Steve discuss the gap between “real world” computer security and “academic” computer security, the problem of cryptography, whether it’s OK to use “the NASCAR effect” to draw students into security, and spear phishing.

• Steve Myers
• Center for Applied Cybersecurity
• The SEED Project (Developing Instructional Laboratories for Computer SEcurity EDucation)
• Why Mobile to Mobile Malware Won’t Cause a Storm [PDF], paper for USENIX ’11, with Nathaniel Husted
• Patrick Traynor
• Silver Bullet Show 020:­ An Interview with Markus Jakobsson
• Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft, edited by Steve Myers and Markus Jakobsson
• “Spear phishing”
• Spirit of the West

On the 68th episode of The Silver Bullet Security Podcast, Gary is joined in the studio by John Steven, internal CTO at Cigital. Gary and John discuss how software architecture is being pulled by financial services instead of being pushed by technology firms, why architecture risk analysis is so important (and so hard to automate), the bias that developers and security practitioners show towards security features rather than software security Touchpoints, and enterprise use of static analysis tools. They close out the show discussing mixology.

• John Steven @ Justice League blog
• OWASP NoVA
• Software [In]security: Comparing Apples, Oranges, and Aardvarks (or, All Static Analysis Tools Are Not Created Equal), InformIT.
• Moving to Mobile – New Threats, Justice League blog.
• Threat Modeling – Vocabulary, Justice League blog.
• BSIMM
• “The Liberal”
• “The Old Fashioned”
• Silver Bullet: Elinor Mills

On the 67th episode of The Silver Bullet Security Podcast, Gary talks with Bill Pugh, professor at the University of Maryland College Park. Gary and Bill discuss the Marmoset and FindBugs projects, how to teach kids to code and whether coding is an innate ability or is something that can be taught. They also geek out regarding Bill’s favorite programming languages for coding and teaching about coding. They also discuss the relationship between coding and fire eating.

• Bill Pugh
• Marmoset
• Dilbert minivan strip
• Find Bugs
• David Hovemeyer
• Find Bugs t-shirt
• Cliff Click
• UMD: Fall 2011 CMSC 433 – Programming Language Technologies and Paradigms

On the 66th episode of The Silver Bullet Security Podcast, Gary chats with Shari Lawrence Pfleeger, Director of Research for the Institute for Information Infrastructure Protection at Dartmouth College. Gary and Shari discuss the difference between safety-critical software and security-critical software, why measuring software is hard (security notwithstanding), how to speed up tech transfer, and why there are so few women in computer science.

• Shari Lawrence Pfleeger
• Software Engineering: Theory and Practice, 4th edition
• Many media types live in the land of Twitter, but most regular people don’t by Monica Hesse in the Washington Post
• My Blackberry’s Not Working!, The One Ronnie
• The Hours by Michael Cunningham

On the 65th episode of The Silver Bullet Security Podcast, Gary is joined by Giovanni Vigna, professor of Computer Science at UC Santa Barbara. They discuss DEFCON’s classic Capture the Flag contest as well as UCSB’s international version. They ponder how the notion of “build security in” might be integrated into a CTF-type contest. Gary and Giovanni also talk about Giovanni’s favorite course to teach, the challenge of communicating security issues with non-technical people, and the role of blackbox testing in security. They close out the show discussing how to teach a toddler to pick locks.

• Giovanni at UCSB
• DEFCON Capture the Flag
• Internatonal Capture the Flag
• Building Versus Breaking: A White Hat goes to Blackhat

On the 64th episode of The Silver Bullet Security Podcast, Gary chats with Markus Schumacher, co-founder and CEO of Virtual Forge. Gary and Markus discuss the difference between working for a large corporate and a startup, why Virtual Forge built a code scanning tool for SAP’s ABAP code, whether security people understand the notion of security patterns, and Markus’ favorite beverage in Heidelberg.

• Virtual Forge
• Security Patterns, the site
• Security Patterns, the book
• Technology Transfer: A Software Security Marketplace Case Study, (IEEE Software, September/October 2011)
• Print Media Lounge
• Recipe for a Liberal (the drink)
• Out of Damage, Markus’ band

• Dr. Craig Miller
• MAPA Group
• SAIC
• Smart grid
• NRECA
• NERC
• Continuous improvement
• On the Waterfront
• Moby Dick

On the 62nd episode of The Silver Bullet Security Podcast, Gary chats with Halvar Flake (a.k.a. Thomas Dullien), founder of reverse engineering consultancy, Zynamics, which was recently purchased by Google. Gary and Halvar discuss the acquisition, Zynamics’ product BinDiff, whether the “bad guys” are using code understanding tools (including decompilers) better than developers, static versus dynamic analysis, international politics meets computer security, and the growing complexity of malware. They close out with a discussion of music.

• ADD / XOR / ROL – Halvar’s blog
• @halvarflake
• US Denies Entry (2007)
• Cyber Warmongering and Influence Peddling (November 24, 2010)
• Google’s purchase of Zynamics
• BinDiff
• Silver Bullet #41: Fred Schneider
• Silver Bullet #46: David Rice

On the 61st episode of The Silver Bullet Security Podcast, Gary talks with Carl Landwehr, Director of Trustworthy Computing at the National Science Foundation and a Senior Research Scientist at the Institute for Systems Research within the University of Maryland. Gary and Carl discuss the most important changes in information security that have developed over the course of Carl’s career, the academic perspective of the state of commercial computer security, how to balance security and privacy, and the reason behind the leaking of government documents to Wikileaks. They close out the episode discussing books.

• Carl Landwehr
• National Science Foundation
• IEEE Security & Privacy Magazine
• Silver Bullet #46: David Rice

On the 5th anniversary, 60th episode of The Silver Bullet Security Podcast, Gary talks with Neil Daswani, CTO and co-founder of Dasient. Gary and Neil discuss Neil’s previous work at Google and how the “start-up like” atmosphere at Google compares with an actual start-up. They also discuss bad ads (aka malvertising), Clickbot.A, the software security related emphasis on testing at Google, and sushi in San Jose.

• Dasient
• Neil Daswani
• Dasient Q4 2010 Malware Update
• Certifiable, McGraw on Software Security Certification for darkreading (May 9, 2007)
• Dasient Resource Center
• The Anatomy of Clickbot.A [PDF]
• Stanford Advanced Security Certification Program
• Tomo Sushi

On the bonus-length 59th episode of The Silver Bullet Security Podcast, Gary chats with Ralph Langner, Founder and CEO of Langner Communications. Langer Communications is a German company specializing in control systems security. Ralph was the first to determine that Stuxnet is a directed cybersecurity attack against the kinds of Siemens control systems used to control nuclear centrifuges in Iran. Gary and Ralph discuss what’s involved in introducing the concept of cybersecurity to control systems engineers, how anti-virus vendors originally responded to the Stuxnet, as well as plenty of detailed technical info about the worm with an emphasis on its payload.

• Langner Communications
• Stuxnet
• Software [In]security: How to p0wn a Control System with Stuxnet
• Software [In]security: Cyber Warmongering and Influence Peddling
• Israeli Test on Worm Called Crucial in Iran Nuclear Delay (New York Times)

On the 58th episode of The Silver Bullet Security Podcast, Gary talks with John Savage, professor of Computer Science at Brown University and Jefferson Science Fellow for the State Department. Gary and John discuss whether Wikileaks is a terrorist organization, if the use of a cyber-weapon like Stuxnet can be a morally justified act, and the implications of computational nanotechnology on cybersecurity.

• Transcript of this episode [PDF]
• John Savage at Brown University
• Jefferson Science Fellow: Dr. John Savage
• International Telecommunication Union
• Silver Bullet #49: Ivan Arce
• The Girl with the Dragon Tattoo
• Homomorphic Encryption

On the 57th Silver Bullet Security Podcast, Gary talks with Elinor Mills, senior writer at CNET’s news.com. At CNET, Elinor covers Internet technology and security. Gary and Elinor discuss how writing about technology for news organizations has changed over the last 20 years, how technology adoption in Portugal differs from the States, WikiLeaks and the First Amendment, avoiding FUD when covering a breaking news story about security, and Burning Man. They close the episode with a brief discussion of Elinor’s favorite books.

• Transcript of this episode [pdf]
• Elinor at CNET
• Insecurity Complex – Elinor’s blog
• Elinor on Twitter
• Drama in the Desert: Sights and Sounds of Burning Man / Raised Barn Press
• Demilitarizing cybersecurity (Q&A)
• How to p0wn a Control System with Stuxnet
• Intellus
• Reputation Defender
• Eating Animals
• The Corrections

On the 56th Silver Bullet Security Podcast, Gary sits down with Sammy Migues, Principal and Director of Knowledge Management at Cigital. Gary and Sammy discuss how Sammy’s southern upbringing affects his approach to security, his experience speaking to the National Rural Electric Cooperative Association, the advantages of defensive programming versus “the bug parade” and the BSIMM. They close the show out discussing bourbon. As a bonus, Sammy may be the first person to ever use the phrase “flips my bogometer” on a podcast.

• Sammy at Cigital
• Sammy on Justice League
• At the NRECA conference – Sammy’s blog post (with video) about his NRECA talk.
• BSIMM Community Conference
• BSIMM
• Trusted Computer System Evaluation Criteria – aka “The Orange Book”
• “The Antique Collection” bourbon

On the 55th Silver Bullet Security Podcast, Gary chats with Deborah Frincke, Chief Scientist, Cybersecurity at Pacific Northwest National Laboratory. Gary and Deb discuss the differences between being a professor and a researcher, whether a professional certification is better than an academic degree, and how a woman’s reasons for getting into the computer security field may differ from a man’s. They close out the episode by talking flowers.

• Deborah Frincke on Twitter
• Software [In]security: Technology Transfer, informIT
• Pacific Northwest National Labs
• University of Idaho Computer Science
• University of Idaho Center for Secure & Dependable Systems
• NSA National Centers of Academic Excellence
• Orchidaceae

On the 54th Silver Bullet Security Podcast, Gary talks with Dr. Marc Donner, engineering director for Google Health and Google Finance. Gary and Marc discuss science-fiction books from the last decade, why Americans like to talk about cyberwarfare, and security issues and privacy concerns as related to Google Health initiatives. They finish up their discussion by talking about the Syrup Wars.

• Marc Donner
• hacks from the bleeding edge (Marc’s blog)
• AI Bites Man? (and the rest of the Biblio Tech archives)
• Iron Sunrise, Singularity Sky

On the 53rd episode of The Silver Bullet Security Podcast, Gary interviews Richard Bejtlich, Director of Incident Response for General Electric and Principal Technologist for GE’s Global Infrastructure Services division. They discuss whether it’s better to look for known problems or anomalies when performing network security monitoring, how to explain security incidents to “business guys,” the notion of “building visibility in,” and the difference between working as an independent consultant in a very small shop and working in a large corporation.

• TaoSecurity blog
• Silver Bullet #19: Mikko Hyppönen
• Silver Bullet #41: Fred Schneider
• VizSec 2010 keynote

On the 52nd episode of The Silver Bullet Security Podcast, Gary chats with Paul Kocher, President and Chief Scientist of Cryptography Research. Gary and Paul discuss the first system that Paul ever broke, whether engineers and architects need to think like the “bad guys” or not, the decision to put content protection on Blu-Ray discs rather than the player, and whether P=NP.

• Transcript of this episode [PDF]
• Cryptography Research (Paul @ Cryptography Research)
• How Crypto Won the DVD War
• Macrovision to Acquire Blu-ray Disc Security Technology from Cryptography Research, Inc. (press release)
• P versus NP problem

On the 51st episode of The Silver Bullet Security Podcast, Gary talks with former co-worker Dr. Anup Ghosh. Anup has authored three books on e-commerce security and over 40 peer-reviewed articles and is founder and chief scientist of Invincea. Gary and Anup discuss the difference between working in a startup and in goverment research, why antivirus doesn’t work against the ZeuS botnet and what businesses should do to protect themselves, and the relevance of the desktop in the future of computing. They close out with a discussion about Anup’s favorite newspapers and recent books.

• Invincea
• Anup’s books on Amazon
• Advanced Technology Program
• ZeuS botnet summary
• Why Patching Isn’t Enough

This special edition of Silver Bullet was also captured on video. View the video below (for those on feed readers, go to this episode’s page for the video):

• Transcript of this episode [PDF]
• Richard A. Clarke
• Cyber War
• 9/11 Commission Report
• What if the smart grid has stupid security?
• Select TV appearances: The Daily Show (2008) / The Colbert Report (2007) / The Colbert Report (2005) / 60 Minutes (2004)

On the 49th episode of The Silver Bullet Security Podcast, Gary talks with Ivan Arce, co-founder and CTO of Core Security Technologies. Gary and Ivan discuss whether teaching builders to think like attackers is worthwhile, how living in Argentina both helps and hinders a career in computer security, the current state of embedded systems attacks, and Ivan’s ongoing disagreement with Microsoft about Virtual PC vulnerabilities. They close things out with a discussion of science fiction books and whether scotch trumps bourbon.

• Core Security Technologies
• Ivan @ Core Security Technologies
• Attack Points blog (CSO Online)
• Ivan on the Core Security Technologies’ blog
• Security vulnerability in Microsoft’s Virtual PC
• Assume Nothing: Is Microsoft Forgetting a Crucial Security Lesson?
• SiSU manifest of document filetypes and metadata

On the 48th episode of The Silver Bullet Security Podcast, Gary interviews Andrew Jaquith, senior analyst at Forrester. Gary and Andy discuss how security has become overrun by compliance in the biggest change to corporate security in 15 years, the battle between social networking technology use in the workplace (think Twitter, Facebook, AIM…) and security, security metrics (or lack of such), and Andy’s latest musical find.

• Andrew Jaquith
• Andy on Twitter
• Data Security Predictions For 2010 (December 02, 2009)
• Know Your Code: How Static Analysis Tools Make Applications More Secure (November 20, 2009)
• BSIMM
• @stake
• Securitymetrics.org
• Security Metrics: Replacing Fear, Uncertainty, and Doubt
• S/MIME
• Silver Bullet #26: Adam Shostack
• Moby: “Southside (feat. Gwen Stefani)”

On the 47th episode of The Silver Bullet Security Podcast, Gary calls in from Leuven, Belgium to chat with childhood friend and security expert Greg Morrisett. Greg is the Allen B. Cutting Professor of Computer Science and Associate Dean for Computer Science and Engineering in the School of Engineering and Applied Sciences at Harvard University. Gary and Greg discuss the relationship between security and programming languages, why the choice of a good programming language (and/or VM) is more important than code review, sensor networks and security, information control, and Gary and Greg’s most embarrassing moment from adolescence.

• Transcript of this episode [PDF]
• Greg Morrisett
• The Center for Research on Computation and Society
• Ynot
• RoboBees
• NoBot
• GoNative

On the bonus-length 46th episode of The Silver Bullet Security Podcast, Gary talks with David Rice, Executive Director of the Monterey Group and author of Geekonomics: The Real Cost of Insecure Software. Gary and David discuss David’s involvement with Infowar at the Naval Postgraduate School and how it impacted his thinking about software, the recent Chinese cyberattack on Google, what incentives exist to create and apply software security best practices, how users may be mistaking marketing for security, and the SANS WhatWorks in Application Security Summit. They close out by discussing unusual yoga positions.

• Monterey Group
• Geekonomics: The Real Cost of Insecure Software (also: Geekonomics Blog)
• Silver Bullet #41 – Fred Schneider
• Silver Bullet #11 – Dorothy Denning
• Software Security Comes of Age (InformIT) – on the growth of the software security space
• Google Defends Against Large Scale Chinese Cyber Attack
• SANS WhatWorks in Application Security Summit 2010
• BSIMM
• Beached Whale yoga position

On the 45th episode of The Silver Bullet Security Podcast, Gary chats with Lorrie Cranor, Associate Professor of Computer Science and Engineering and Public Policy at Carnegie Melon University. Gary and Lorrie discuss how everyday people think about privacy and what we can do to get them to care about it, the relationship between trust and privacy, and why the US is lagging behind the EU on privacy-related issues. They close out the discussion by talking about women in computing.

• Lorrie Cranor
• Security and Usability: Designing Secure Systems That People Can Use
• Web Privacy with P3P
• CyLab Usable Privacy and Security Laboratory (CUPS)
• A “Nutrition Label” for Privacy
• BSIMM Europe
• Google search privacy video

On the 44th episode of The Silver Bullet Security Podcast, Gary talks with Steve Kent, Chief Scientist – Information Security, for BBN Technologies, a division of Raytheon. Gary and Steve discuss the history of network security, secure transport and base Internet protocols, the role of politics in the adoption of security on the Internet, applied cryptography, and whether security and individual liberty co-exist. They finish by discussing extremely high end wine.

• Internet’s Biggest Security Hole
• Securing the Border Gateway Protocol (PPT)
• 2006: Statement before Congress regarding a nationwide ID system
• BSIMM Europe

On the 43rd episode of The Silver Bullet Security Podcast, Gary chats with Christofer Hoff, Director of Cloud and Virtualization Solutions at Cisco. Hoff is well known for his colorful blog posts and presentations on cloud security and other complex security issues. Suffice it to say, the cloud was a big topic for this issue. And rum.

• Transcript of this episode [PDF]
• Christofer Hoff
• Rational Survivability
• The Frogs Who Desired a King: A Virtualization & Cloud Computing Fable
• Cloudifornication: Indiscriminate Information Intercourse Involving Internet Infrastructure
• Mount Gay Extra Old Rum (Gary’s favorite)
• Ron Zacapa Centenario Rum (Hoff’s favorite)

On the 42nd episode of The Silver Bullet Security Podcast, Gary chats with Gillian Hayes, Assistant Professor in Informatics at the Bren School of Information and Computer Sciences at UC Irvine. Gary and Gillian discuss how much people really need to know about security going on behind the scenes, how usability affects the health records security, whether or not surveillance changes how 20-somethings act in public (including on the net), and how having more women technologists positively impacts the humanization of technology.

• Transcript of this episode [PDF]
• Gillian Hayes
• Social and technological action research (STAR)
• Ben Shneiderman
• National Center for Women and Information Technology
• The Discovery of Heaven

On the 41st episode of The Silver Bullet Security Podcast, Gary talks with Fred Schneider, Samuel B. Eckert Professor of Computer Science at Cornell University and author of Trust in Cyberspace. On the show, Gary and Fred discuss the relationship between security and reliability, diversity as a security mechanism, and the continuum of attack categories from configuration problems, to bugs, to flaws, to trust issues. Fred briefly discusses Pointillism at the end of the show.

• Transcript of this episode [PDF]
• Fred B. Schneider
• IEEE Security and Privacy 7, 1 (January/February 2009) [PDF], 14–17. With Ken Birman.
• Trust in Cyberspace
• Pointillism (Seurat)

For the 40th episode of The Silver Bullet Security Podcast, Gary interviews Bob Blakley, VP and research director of The Burton Group’s Identity and Privacy Strategies. Gary and Bob discuss the importance of liberal arts degrees, the (over) complications of CORBA security, whether computer security requires a complete shift in approach, cybersecurity and governments, and the movie Perils in Nude Modeling (really).

• Transcript of this episode [PDF]
• Ceci n’est pas un Bob – Bob’s blog
• CORBA Security: An Introduction to Safe Computing with Objects
• NDSS’98 Trust Management Panel: LE NOZZE DI NOMEN [PDF] – The NDSS “wedding script”
• “The Emperor’s Old Armor“
• Moving U.S. Cybersecurity Beyond Cyberplatitudes
• Perils in Nude Modeling

For the 39th episode of The Silver Bullet Security Podcast, Gary chats with Matt Blaze, Associate Professor of Computer and Information Science at the University of Pennsylvania. Gary and Matt start the show off discussing the Obama administration’s “cyber coordinator” plan and the large number of cyber plans that are never cyber realized. They also discuss key escrow, warrantless wiretapping, the responsibility we have to stay engaged with issues surrounding individual liberty and privacy, and the similarities between physical locks and computer security. Matt’s musical tastes are also briefly touched on.

• Matt Blaze
• Matt Blaze – Wikipedia
• Matt Blaze’s Exhaustive Search – Matt’s blog
• Safecracking, Secrecy and Science
• Cryptology and Physical Security: Rights Amplification in Master-Keyed Mechanical Locks – IEEE Security & Privacy, March/April 2003
• RSA panel on Surveillance
• Silver Bullet 11: Dorothy Denning
• Trust Management
• Signaling Vulnerabilities in Wiretapping Systems – IEEE Security & Privacy, November/December 2005, by M. Sherr, E. Cronin, S. Clark and M. Blaze.
• Eno/Byrne: Everything That Happens Will Happen Today

For the 38th episode of The Silver Bullet Security Podcast, Gary talks privacy with Kay Connelly, Associate Professor of Computer Science at Indiana University and Senior Associate Director of IU’s Center for Applied Cybersecurity Research. Gary and Kay discuss why in situ usability study is important, the E.T.H.O.S. living lab (including the “presence clock” and the portal monitor), and Kay’s advice to women interested in pursuing a career in computer science.

• Kay Connelly
• E.T.H.O.S. – Ethical Technology in the Homes of Seniors
• Crafting a Smarter, Gentler Cell Phone – NPR story featuring Kay Connelly
• Why It’s Worth the Hassle: The Value of In-Situ Studies When Designing Ubicomp [PDF]
• Silver Bullet #7: John Stewart
• Silver Bullet #15: Annie Antón
• HIPAA
• Ambient (Presence) Clock
• Portal Monitor
• The Song Is You: A Novel by Arthur Phillips
• I Was Told There’d Be Cake by Sloane Crosley

On the 37th episode of The Silver Bullet Security Podcast, Gary interviews Virgil Gligor, Professor at Carnegie Mellon University in the Department of Electrical and Computer Engineering and co-director of CyLab. Gary and Virgil discuss how information security has changed over the last 35 years, why software security will be with us forever, and how Virgil’s childhood in Romania has shaped his views on security. They close out with a discussion of Virgil’s breakfast-eating habits.

• Transcript of this episode [PDF]
• Virgil D. Gligor (@ Carnegie Mellon)
• CyLab
• Electrical and Computer Engineering at Carnegie Mellon University
• Building a Secure Computer System
• Foreign Intelligence Surveillance Act
• Software Security Comes of Age
• RSA panel to discuss surveillance, privacy concerns
• Computer Security: Art and Science by Matt Bishop
• Towards a Theory of Penetration-Resistant Systems and its Applications (1991)
• A Formal Method for the Identification of Covert Storage Channels in Source Code (1987)

We switch things up for this special third anniversary episode of Silver Bullet. This time around, Gary is the victim, being interviewed by James McGovern, Enterprise Architect for The Hartford Financial Services Group, Inc. and OWASP maven. Gary and James discuss the recently released Building Security In Maturity Model, how companies with Software Security Groups retain their best and brightest, Microsoft’s trustworthy computing initiative/SDL program, and what less expensive tools small organizations with only a few developers can use.

• Transcript of this episode [PDF]
• Enterprise Architecture: From Incite comes Insight… – James McGovern’s blog
• Gary McGraw’s site
• Software Security: Building Security In
• Building Security In Maturity Model (BSIMM)
• Gartner releases paper on Static Analysis – James’ blog entry on Gartner
• Cigital’s John Steven to lead OWASP Northern Virginia Local Chapter (press release)

On the 35th episode of The Silver Bullet Security Podcast, Gary talks with Daniel Suarez, independent consultant and author of Daemon, a new techno-thriller about a gamer that reaches from beyond the grave to declare a war on all of humanity. They talk about Daniel’s new book and the movie options attached to it, the use of MMORPGs and flash mobs for nefarious means in the form of a distributed emergent attack, the current state of AI, and the follow-up to Daemon, Freedom ^TM.

• Daemon
• Daniel on Last call with Carson Daly
• Al-Qaeda in Second Life
• Distraction by Bruce Sterling
• Halting State by Charles Stross
• Bot-Mediated Reality at the Long Now Foundation
• Wired for War by P.W. Singer

On the 34th episode of The Silver Bullet Security Podcast, Gary interviews Bill Brenner, senior editor at CSO Online and CSO Magazine. Gary and Bill discuss how delivering the security message changes based on the audience (executives versus geeks and CSO’s versus CIO’s), the much-exaggerated death of print media, and balancing headline-grabbing sensationalism with solid security business coverage. They close out their interview with a discussion of Bill’s favorite period of history.

• Bill Brenner at CSO Online
• Bill Brenner on LinkedIn
• Bill Brenner on Facebook
• Security Wire Weekly
• Security Insights Podcast
• 1 Raindrop – Gunnar Peterson’s blog.
• Silver Bullet interviews with Jon Swartz, USA Today, Dennis Fisher, Tech Target, and Jeremiah Grossman, Whitehat

We’re happy to announce the debut of The Reality Check Security Podcast with Gary McGraw:

The Reality Check Podcast with Gary McGraw focuses directly on software security practitioners and practical software security. Reality Check’s sister podcast, the Silver Bullet Security Podcast with Gary McGraw, follows a free form interview style tailored highlight the ideas and experience of security gurus. By contrast, Reality Check is concerned with practical questions centered on running large-scale software security initiatives in the real world.

Reality Check targets experienced leaders working to solve software security problems in large organizations every day. We use a standard script to guide each conversation with questions about history, methodology, best practice, and measurement. We plan to interview leaders of mature software security programs and leaders of programs just getting started.

On the 33rd episode of The Silver Bullet Security Podcast, Gary talks with Laurie Williams, Associate Professor of Computer Science at North Carolina State University. Gary and Laurie discuss Laurie’s nine years at IBM, Agile’s adoption in the commercial space, XP and software security, and what changes Laurie would make to the standard computer science curriculum to better prepare students.

• Laurie Williams
• Empirical Software Engineering
• Protection Poker tutorial
• Is Complexity Really the Enemy of Software Security? [PDF]
• Silver Bullet interview with Adam Shostack
• Law of Attraction audiobook

The 32nd episode of The Silver Bullet Security Podcast features founder and Chief Technology Officer of WhiteHat Security, Jeremiah Grossman. Gary and Jeremiah discuss clickjacking, cross-site request forgery, why 50% of web problems can’t be discovered reliably automatically, and which conferences Jeremiah most enjoyed on his 2008 world tour.

• Transcript of this episode [PDF]
• Jeremiah Grossman
• Clickjacking
• Adobe 0-day Browser Exploit
• Cross-Site Request Forgeries: Exploitation and Prevention [PDF]
• Web Spoofing: An Internet Con Game by Edward W. Felten, Dirk Balfanz, Drew Dean, and Dan S. Wallach.
• Web application scan-o-meter
• The “Wall of Fame”

On the 31st episode of The Silver Bullet Security Podcast, Gary talks with Matt Bishop, professor of Computer Science at UC Davis and author of the book Computer Security: Art and Science as well as many peer-reviewed papers. Gary and Matt discuss Matt’s plan to work security analysis and secure coding into a wider computer science cirriculum, Matt’s early work with Mike Dilger on TOCTOU, whether or not progress is being made in the field of software security, and the role of training in large-scale software security initiatives. Their chat closes with a mention of Matt’s home menagerie (which does not include any one-legged chickens at this time).

• Transcript of this episode
• Matt Bishop
• IEEE Security & Privacy Magazine
• Computer Security: Art and Science
• Silver Bullet Security Podcast interview with Dorothy Denning
• Security Controls for Computer Systems: Report of Defense Science Board Task Force on Computer Security (the “Ware Report” referred to in the podcast)
• Secure Computer Systems: Mathematical Foundations – The Bell Lapadula model [PDF]
• Secure Computer System: Unified Exposition and Multics Interpretation [PDF]
• Testing C Programs for Buffer Overflow Vulnerabilities – Eric Haugh, Matt Bishop [PDF]
• TOCTOU
• Checking for Race Conditions in File Accesses by Matt Bishop and Michael Dilger
• “The Song of the One Legged Chicken”

On the 30th episode of The Silver Bullet Security Podcast, Gary talks with Ken van Wyk, principal and founder of KRvW Associates. Ken was the first employee of CERT and has been an active member of FIRST. Ken and Gary discuss why the discipline of computer science doesn’t learn from failure like mechanical engineering does, how we’re making steps backwards in computer security, whether focusing on web applications is a good or bad thing for software security, and Ken’s recommendation for moderately-priced red wines.

• Ken’s personal page
• KRvW Associates
• CERT
• FIRST
• Secure Coding
• Incident Response
• SC-L mailing list
• From the foreword to Secure Programming with Static Analysis – blog entry with photo of Tacoma Narrows Bridge
• TJX’s stock increase since the January 2007 security breach
• The Addison-Wesley Software Security Series
• Barbera D’Asti wines

On the 29th episode of The Silver Bullet Security Podcast, Gary talks with Dennis Fisher, executive editor of The Security Media Group at TechTarget. Dennis helps run SearchSecurity.com and Information Security Magazine. Gary and Dennis discuss the current “BS factor” in security journalism, shopping at TJ Maxx right after the TJX privacy breach, the state of software security, and which is harder: being a fry cook at Hardees or working as a PR flack.

• Dennis’ blog
• TJX
• Joe Walsh plays dirty laundry
• Software Security Grows
• Dennis’ un-named podcast
• Series of Tubes
• Hardees
• Nike/iPod

On the 28th episode of The Silver Bullet Security Podcast, Gary interviews Bill Cheswick, a lead member of technical staff at AT&T Research and all around security guru. Bill has been working in computer security for over 35 years. He coined the term “proxy” in 1990 with reference to firewalls, and co-authored the book Firewalls and Internet Security which was used to train an entire generation of sys admins. Gary and Bill discuss whether we’re winning or losing the computer security war, how security threats have evolved from pimply-faced teenagers to organized crime, whether we should move security into “the cloud,” and whether re-naming “Christmas lights” to “solstice lights” would bypass NJ holiday decoration ordinances.

• Transcript of this episode [PDF]
• Bill Cheswick
• AT&T Research
• Lumeta
• FWIS
• “The Design of a Secure Internet Gateway” (Usenix 1990, coining of “proxy”)
• The Apache web server
• Turtles all the Way Down
• Ed Amoroso’s Silver Bullet Podcast (use blink test to compare)
• Solstice Lights

On the 27th episode of The Silver Bullet Security Podcast, Gary interviews software security expert Gunnar Peterson, a Managing Principal at Arctec Group. Gary and Gunnar begin with the age-old question, “What is security?” They go on to discuss how Web 2.0 and SOA security is progressing, the big idea behind “federated identity,” whether all market verticals can follow the software security lead of the financial services industry, and the inherent badness of the color purple.

• Transcript of this episode [PDF]
• Build Security In column from IEEE S&P
• Gunnar’s Blog
• informIT (Securing Web 3.0)
• Metricon 3.0
• Butler Lampson on Security
• Federated Identity
• Ping Identity
• Gerald Weinberg
• Verizon Business Security: Patching Conundrum

The 26th episode of The Silver Bullet Security Podcast features Adam Shostack, a security expert on Microsoft’s Secure Development Lifecycle team who has also worked for Zero Knowledge and Reflective. Gary and Adam discuss how Adam got started in computer security, how art/literature informs Adam’s current work, and the main ideas behind Adam’s new book The New School of Information Security. They go on to chat about Adam’s aversion to the term “best practices,” the role IEEE Security & Privacy magazine plays in bringing the science of security to a practical level, and whether the biggest problem of the CardSystems breach was the following the letter, rather than the spirit, of PCI. Also on the agenda, duck-billed platypuses, Kandinski, and books by Pynchon.

(Beginning with this episode, Silver Bullet will be available as a 192k MP3.)

• Transcript of this episode [PDF]
• Emergent Chaos blog
• The New School of Information Security
• Microsoft’s SDL
• Cigital’s Touchpoints
• IEEE Security & Privacy magazine
• Wassily Kandinsky
• The CardSystems breach (2005)
• Thomas Pynchon

Jon Swartz, USA Today‘s award-winning technology reporter and Pulitzer Prize nominee, is Gary’s guest on the 25th episode of The Silver Bullet Security Podcast. They discuss Jon’s new book, Zero Day Threat: The Shocking Truth of How Banks and Credit Bureaus Help Cyber Crooks Steal Your Money and Identity and the research that went into writing it. Gary and Jon also cover how cybercrime is driven by capitalist principals, why the general public’s attitude is so lax about software security, and how, even though it’s hard to get an accurate count of identity theft instances, they tend to show a sharp upward trend. Jon ends the episode by disclosing his secret dream career.

(Apologies for the below-average sound quality on this episode.)

• Transcript of this episode [PDF]
• Zero Day Threat
• Jon’s USA Today articles
• Three recent articles:
• Microsoft still seen with a win
• Online crime’s impact spreads
• AOL, News Corp. join battle over Yahoo
• The New Face of Cybercrime trailer

Oracle Chief Security Officer Mary Ann Davidson is the guest on the 24th episode of The Silver Bullet Security Podcast. Gary and Mary Ann discuss how an MBA helps in the CSO role, Oracle’s “Unbreakable” campaign, why everyone needs training in secure coding, and how military history informs computer security. They also talk about how a young CSO-to-be got her first library card.

• Mary Ann Davidson’s blog
• Unbreakable Linux
• Lone Survivor

On the 23rd episode of The Silver Bullet Security Podcast, Gary talks with Chris Wysopal, founder and CTO of Veracode and author of The Art of Software Security Testing. Chris was one of the seven original members of the L0pht hacker collective (operating under the hacker handle Weld Pond) and later went on to work for @stake. Gary and Chris reminisce about L0pht (and the warehouse full of stuff) and discuss the role of security researchers now versus in the mid-late ’90s. They also talk about the current state of the software security market and its continued growth.

• Chris’ Wikipedia entry
• The Art of Software Security Testing
• Veracode
• Zero in a bit – Veracode’s blog
• L0pht Heavy Industries
• Vulnwatch
• SOURCE: Boston 2008

On the 22nd episode of The Silver Bullet Security Podcast, Gary interviews Ed Amoroso, Chief Information Security Officer of AT&T. They discuss how Peter Neumann influenced Ed, the difference between bugs and flaws and whether bugs are getting too much attention, the propensity for confusion around how security actually works, privacy, security, and monitoring, and software correctness/quality vs software security. They also discuss the Hugh Thompson show now airing on AT&T’s Tech Channel.

• Transcript of this episode [PDF]
• Cyber Security
• Fundamentals of Computer Security Technology
• Silver Bullet Interview with Peter Neumann
• AT&T’s Tech Channel
• Gary on The Hugh Thompson Show

For the 21st episode of The Silver Bullet Security Podcast, Gary hosts a panel discussion with Cigital’s principals. Participants include Sammy Migues (Director of Training and Knowledge Management), John Steven (Principal Consultant) and Pravir Chandra (Principal Consultant). The group discusses the best ways for large companies to get started with software security and the similarities between CLASP, Microsoft’s SDL, and the Security Touchpoints. They also ponder how much the security testing burden should fall on QA and whether developing expertise in architectural risk analysis or threat modeling is more helpful. John Steven also discusses the hole in his dining room, which threat modeling would not have helped to prevent.

• Transcript of this episode [PDF]
• Justice League blog
• Threat Modeling – a blog entry by John Steven
• OWASP Top 10 for 2007
• OWASP
• The Shmoo Group

For the landmark 20th episode of The Silver Bullet Security Podcast, Gary interviews Markus Jakobsson, soon to be a reseacher at PARC after a stint as an Associate Professor of Informatics and associate director of the Center for Applied Cybersecurity Research at Indiana University. Gary and Markus discuss the difference between academic and corporate research, the idea of “perfect privacy,” moving from hardcore cryptography to sociology, how reality is mimicking phishers, and how cartoons can be used to teach security. In addition, Markus mentions the best place in Southeast Asia to get a haircut.

• Markus @ Indiana
• Markus @ Wikipedia – he’s “orphaned”!
• RavenWhite
• SecurityCartoon.com
• Crimeware
• Phishing and Countermeasures
• Using Cartoons to Teach Internet Security

For the 19th episode of The Silver Bullet Security Podcast, Gary interviews Mikko Hyppönen, Chief Research Officer at F-Secure. During this show, Gary and Mikko discuss Helsinki and Finnish pronunciation, whether mobile viruses are all hype or a legitimate threat, if the iPhone as a closed system is good or bad for security, and Mikko’s prediction for the appearance of the first mobile botnet. They also chat about Finnish hip-hop.

• Transcript of this episode [PDF]
• Mikko Hyppönen
• Mikko Hyppönen- Wikipedia
• F-Secure
• Mobile Malware – Mikko’s USENIX 2007 talk, both audio and video (scroll down a bit)
• Xevious
• The FSMCs

On the 18th episode of The Silver Bullet Security Podcast, Gary talks with Dr. Eugene Spafford, better known as “Spaf.” Spaf is a professor of computer science and Electrical and Computer Engineering at Purdue University and executive director of the Center for Education and Research in Information Assurance and Security (CERIAS). On this episode, Gary and Spaf discuss the role of software testing in computer security, commercial certifications and whether they obviate the need for academic training, how Spaf feels about so-called “ethical hacking,” and why auditing and compliance is an area of emerging specialization.

• Transcript of this episode [PDF]
• Dr. Eugene Spafford
• Spaf’s blog at CERIAS
• Gene Spafford – Wikipedia
• CERIAS – Center for Education and Research in Information Assurance and Security
• Mothra – Mutation testing
• PITAC – President’s Information Technology Advisory Committee
• What did you really expect? – Spaf’s post on “reformed hackers”
• The Internet Worm Program: An Analysis
• Yucks Digest

On the 17th episode of The Silver Bullet Security Podcast, Gary talks with Eric Cole, CEO of Secure Anchor. Eric has written seven books on computer security, including books on steganography and network security. Gary and Eric discuss how to demostrate security ROI in different types of organizations (ranging from government to corporate), the academic approach to security versus practitioner certification models, and what kinds of training makes for good network security practitioners. They also discuss the difficulty of certifying software developers.

• Secure Anchor
• Security Haven
• Stego-marking packets to control information leakage on TCP/IP based networks – Eric’s dissertation

On the 16th episode of The Silver Bullet Security Podcast, Gary talks with Greg Hoglund, who runs the popular rootkit.com, CEO of HB Gary, and co-author of Rootkits: Subverting the Windows Kernel and Exploiting Software. In addition to shameless self-promotion of their new book, Exploiting Online Games, Gary and Greg discuss the natural tendency of certain types of code to allow exploits, how disclosure is a good thing when it comes to revealing exploits, and the use of rootkits by the “good guys.” Greg also makes us concerned that his 11-year-old daughter may 0wn our box.

• Rootkit.com
• HB Gary
• Greg’s Blackhat presentation from 2006: Hacking World of Warcraft(r): An Exercise in Advanced Rootkit Design [rar, 2.35M]
• Exploiting Online Games
• AWL Software Security Series

On the 15th episode of The Silver Bullet Security Podcast, Gary interviews Annie Antón, Associate Professor of Software Engineering at North Carolina State University and director of theprivacyplace.org. During their discussion, Annie and Gary focus on privacy. They start with an attempt to define what “privacy” is in the digital world, moving on to Annie’s work with The Privacy Place. Annie also discusses airlines’ pretty much pitiful privacy policies, the impact that a Google/Doubleclick deal would have on consumer privacy, crazy talk in EULAs, and the book Letters to a Young Catholic (which has nothing to do with privacy).

• A partial transcript of the interview in IEEE Security & Privacy
• Annie I. Antón
• The Privacy Place
• The ChoicePoint Data Security Breach
• Letters to a Young Catholic

The 14th episode of The Silver Bullet Security Podcast features Peter Neumann, designer of the Multics OS file system, moderator of comp.RISKS, and Principal Scientist at the SRI Computer Science Laboratory. In this show, Gary and Peter discuss the most important changes in computer security since the 1960s, the discipline involved in early Multics engineering (“nodody writes a line of code without the approving authorities [having] read and understood the specification”), why DRM is the “wrong solution to the wrong problem,” and who was more interesting to meet: Albert Einstein or Norah Jones.

• Peter Neumann
• comp.RISKS
• Computer-Related Risks
• Multics
• A General-Purpose File System For Secondary Storage – Peter’s 1965 paper on Multics
• Multics History Project
• The Brooklyn Boogaloo Blowout

On the 13th episode of The Silver Bullet Security Podcast, Gary chats with Ross Anderson, Professor of Security Engineering at the Computer Laboratory at Cambridge University and author of the book Security Engineering. Gary and Ross discuss the effect of posting his excellent book on the net for free, the simple reasons why most systems fail, the economic imbalance between engineers/developers and a system’s users (with respect to who should address security), and why publicly describing attacks is essential to security engineering. They close out by examining the security implications of wearing a kilt.

• Transcript of this episode [PDF]
• Ross Anderson
• Light Blue Touchpaper – A security blog by Cambridge computer scientists.
• Security Engineering – Ross’ groundbreaking book in print and online
• WEIS 2007 – Sixth Workshop on the Economics of Information Security
• RFID and the Middleman [PDF]
• The Clan Anderson Society
• Ross playing the bagpipes

On the 12th episode of The Silver Bullet Security Podcast, Gary
talks with Becky Bace, Advisor to Venture Capital firm Trident Capital. Becky spent twelve years at the NSA working on intrusion detection and cryptography from 1984 until 1996, followed by a stint at Los Alamos National Laboratory. Gary and Becky discuss growing up in rural America, explosives, and Becky’s Jimmy Hoffa sponsored college funding situation. They also talk about the evolution of security curricula in academia, rampant commercialization of computer security, Becky’s involvement in tracking down the notorious Kevin Mitnick, vicodin-induced creativity, and eclectic music.

• Transcript of this episode [PDF]
• Who’s Who in Infosec: Rebecca Bace
• Trident Capital – The VC firm where Becky is an advisor
• The IDS Den Mother – a 2002 interview
• Los Alamos National Labs
• Intrusion Detection
• A Guide to Forensic Testimony: The Art and Practice of Presenting Testimony As An Expert Technical Witness – Co-authored with Fred Smith
• Executive Women’s Forum
• Frank Sinatra
• The Kinsey Sicks

On the 11th episode of The Silver Bullet Security Podcast, Gary talks with Dorothy Denning, a professor in the Department of Defense Analysis at the Naval Postgraduate School. Previously, Dorothy was a distinguished professor at Georgetown University and a professor at Purdue University. Gary and Dorothy discuss Dorothy’s involvement in the Clipper Chip controversy (which earned Dorothy the moniker “clipper chick”), the concept of geo-encryption, and a famous 1990 paper she wrote describing a series of interviews with malicious hackers.

• Transcript of this episode [PDF]
• Wikipedia: Dorothy Denning
• Clipper Chip (More)
• Clipper Chick – a 1996 Wired article about the Clipper Chip controversy.
• The Future of Cryptography
• Location-Based Authentication: Grounding Cyberspace for Better Security – A 1996 paper by Dorothy Denning and Peter F. MacDoran about geo-encryption.
• Concerning Hackers Who Break into Computer Systems – Dorothy’s 1990 paper.
• Big Sur Power Walk

The tenth episode of The Silver Bullet Security Podcast features a panel discussion with the Fortify Software Technical Advisory Board, several of whom have been featured on previous episodes. The group discusses what commercial software tools can learn from academic research, the state of software security in China, real world lessons learned while using static analysis tools, and software security pedagogy.

Participating members of the Technical Advisory Board include:

• Bill Pugh, Professor at University of Maryland, static analysis for finding bugs
• Li Gong, GM at Microsoft, MSN in China
• Marcus Ranum, CSO of Tenable Network Security, security products trainer
• Avi Rubin, Professor at Johns Hopkins, electronic voting security
• Fred Schneider, Professor at Cornell, trustworthy computing
• Greg Morrisett, Professor at Harvard, dependant type theory
• Matt Bishop, Professor at UC Davis, computer security
• Dave Wagner, Professor at Berkeley, software security and electronic voting

A complete transcript of this podcast will be available soon from Fortify at http://www.fortify.com/silverbullet.

In the ninth episode of The Silver Bullet Podcast, Gary interviews Bruce Schneier. Bruce is the founder and CTO of Counterpane and is regarded as the “uber-guru” of computer security. He has written eight bestselling books, most recently Beyond Fear: Thinking Sensibly About Security in an Uncertain World and is the editor of the massively popular Cryptogram mailing list. In this episode, Gary and Bruce discuss the connection between physical security its technological component, the idea of risk management, the intersection of economics and security, and the ideas of “wholesale surveillance” and “security theater.” They also discuss patch Tuesday, hack Wednesday, and Microsoft’s approach to software security.

• Bruce’s Wikipedia entry
• Bruce’s books
• Bruce’s recent restaurant reviews
• Counterpane
• Crypto-Gram security podcast
• Property Rights Management – Ed Felten’s discussion of PRM, mentioned on the show
• Copyright Mythbusters: Believe It or Not, Fair Use Exists – a look at the “fair use doesn’t exist” argument
• BBC plans attacked for ‘TV tax’ (March 14, 2006)
• Bruce’s suggestion for “cheap” wines: Loire wines, Provence Wines, Southern Rhone wines

In the eighth episode of The Silver Bullet Podcast, Gary talks with Brian Chess, co-founder and chief scientist of Fortify Software. Brian completed his computer science Ph.D. at UC Santa Cruz after several years in the commercial sector. Gary and Brian discuss what commercial developers and academics have to learn from each other, what it’s like to work for a Kleiner-Perkins startup (KP is the VC firm behind familiar names like Google, Amazon, and Sun), and how mystifying it is that some developers are OK with XSS vulnerabilities in their web applications.

• Fortify Software
• extra – Fortify’s software security blog
• Matt Bishop’s Computer Security: Art and Science (mentioned again!)
• Kleiner Perkins Caufield & Byers
• DIMACS Workshop on Software Security with Brian Kernighan
• Brian as a wee lad

In the seventh episode of The Silver Bullet Podcast, Gary interviews Cisco Chief Security Officer John Stewart. Gary and John discuss what CSOs do all day, how John got started in computer security, and the infamous Morris Worm from 1988 (which John was deeply involved in while a student at Syracuse). John and Gary also revisit Cisco-gate, talk about how John’s identity was stolen, and determine why John’s kids don’t have e-mail addresses.

• Transcript of this episode [PDF]
• Executive Perspective: John Stewart on Vulnerability Disclosure
• Wikipedia: CSO
• Digital Island
• The What, Why, and How of the 1988 Internet Worm – a look at the history of the Morris Worm
• Cisco-gate
• Five Ways to Fight ID Theft – John talks about finding himself a victim of identity theft; see also: the motorcycle he was trying to buy when he found out
• John Stewart, but not the one Gary interviews (and not the one you’re thinking of)

The sixth episode of the show features an interview with Michael Howard, the Senior Security Program Manager of Microsoft’s Security Technology Unit. Michael has been at Microsoft since 1992 and discusses what it has been like watching the company come to grips with software security. Michael continues to play a key roll in implementing the Trustworthy Computing Initiative at Microsoft. Gary and Michael also discuss the security features of Windows Vista and Michael’s recommendations for the two most important best practices when developing secure software. Listen for a startling revelation about Michael’s choice of a “desert island book.”

• Michael Howard’s blog
• Writing Secure Code by Michael Howard
• Wikipedia: Defense in Depth
• Microsoft’s Trustworthy Computing Security Development Lifecycle
• Matt Bishop’s computer security books – These would go with Michael to a desert island.
• Michael Howard – but not the one Gary interviewed.

The fifth edition of the Silver Bullet Security Podcast features Ed Felten, Professor of Computer Science and Public Affairs at Princeton University and the Director of the Center for Information Technology Policy. Gary and Ed take a look at Ed’s predictions for 2006 and how he’s faring so far and then discuss Ed’s relationship with his former adversaries. They also talk about how to discuss difficult technology issues with lawmakers and the importance of public policy and the law to computer scientists. Ed also outlines the challenges of raising a bright 11-year-old.

• A partial transcript of the interview in IEEE Security & Privacy
• Freedom to Tinker – Ed Felten’s blog
• Ed’s Predictions for 2006
• Wikipedia: Series of Tubes
• Subscribe to IEEE Security & Privacy

In the fourth episode of the Silver Bullet Security Podcast, Gary’s guest is Dana Epp, CEO and founder of Scorpion Software. Dana also runs a popular software security blog and is a jazz trumpeter. On this show, Dana and Gary talk about past programming disasters (“code lives forever”), the security implications of systems with ever-increasing complexity, suggestions for new developers interested in learning about software security, regulation’s role in information security, and Miles Davis.

• SilverStr’s blog – Dana’s blog
• It’s Pat!
• RemoteAccess BBS
• The 5 Rules of the Regulatory Process
• Chris Botti
• SC-L List
• Bitches Brew
• Subscribe to IEEE Security & Privacy

In the third episode of the Silver Bullet Security Podcast, Gary talks with Marcus Ranum, who is an acclaimed security guru widely credited with inventing the proxy firewall. Marcus and Gary discuss why Marcus thinks we’re not making progress in the computer security field, how common sense would help computer security, Richard Feynman, and power tools for home repair and improvement.

• A partial transcript of the interview in IEEE Security & Privacy
• Ranum.com
• BlackHat Keynote ’97 (MP3)
• The Six Dumbest Ideas in Computer Security
• Old West Snake Oil
• Patch Tuesday
• Richard Feynman
• DeWalt cordless screwdriver
• Subscribe to IEEE Security & Privacy

In this episode of the Silver Bullet Security Podcast, Gary chats with Dan Geer, Chief Scientist at Verdasys. Dan has a Ph.D. in biostatistics from Harvard. He and Gary discuss the need to understand both technology and business in order to be a good security practitioner, Dan’s paper Cyber Insecurity, his work on Project Athena, and livestock.

• A partial transcript of the interview in IEEE Security & Privacy
• Dan Geer on Wikipedia
• Cyber Insecurity: The Cost of Monopoly (PDF)
• Project Athena on Wikipedia
• How Much Information 2003
• Subscribe to IEEE Security & Privacy

In the debut episode of the Silver Bullet Security Podcast, Gary talks with Avi Rubin, professor of computer science and technical director of the information security institute at Johns Hopkins University. Avi made headlines in 2003 when he revealed glitches in Diebold electronic voting machines.

Links:

• A partial transcript of the interview in IEEE Security & Privacy
• Avi’s site
• Brave New Ballot: The Battle to Safeguard Democracy in the Age of Electronic Voting, Avi’s forthcoming book
• ACCURATE – A Center for Correct, Usable, Reliable, Auditable, and Transparent Elections
• Froot Loops and Corn Flakes
• Subscribe to IEEE Security & Privacy