The UNSECURITY Podcast – Episode 43 Show Notes

Crap. I had a good streak going for a bit. I was getting show notes published on Friday, but now I’m back to being consistently late with this. Oh well, it is what it is.

Did you catch last week’s show? It was a really good one, where Christophe Foulon joined the show again. He gave us an update on what he’s been up to and reinforced his mission of helping people get into the information security field. Great guy, great mission, and a great talk. Listen to it here.

This week was tough, filled with tough decisions, but the outcome was incredible. I won’t go too much into the details, but I’ll give you a quick recap.

  • My good friend Ryan Cloutier published his first article as a guest on my blog. Ryan’s a great advocate for helping “normal” people learn information security basics, and it’s a honor to have him write something for me/us to share.
  • I was off to New Jersey this week, spending time with a global company’s information security team, building some great information security processes. The two days was filled with some amazing working sessions. We left things much better off than where we found them.
  • Friday was filled with meetings, back to back to back to back. Each meeting was unique, and they all produced positive results. It’s sometimes crazy coming back to the office after a few days away. I love my team and I love being with them, even if it is in a meeting. 😉

OK, show notes. Here they are…

SHOW NOTES – Episode 43

Date: Monday, September 2nd, 2019

NOTE: We recorded this podcast on Friday, August 30th ahead of the Labor Day holiday.

Show Topics:

Our topics this week:

  • Incident Response (why not?)
  • What’s a vCISO?
  • Gaps between us and them
  • Industry News

[Evan] – Some sort of non-standard opening… The standard one is:
“Welcome to the UNSECURITY Podcast, this is episode 43 and the date is sometime in late August. I’m Evan Francen and joining me is my partner in crime, Brad Nigh. Hello Brad.”

[Brad] Brad does Brad.

[Evan] We have a packed show in store again today. We’re recording this episode on Friday because Monday is Labor Day. Summer is over. What the ?!?! Got plans?

[Brad] Brad still does Brad because Brad is Brad.

[Evan] Hopefully our listeners all had an enjoyable Labor Day and an enjoyable summer. Back to school and back to the grind. Speaking of “back to the grind”, let’s talk about a topic that we always seem to be talking about, Incident Response. I’ll be damned if we don’t have more lessons to share with our listeners. Let’s keep it short though, if we can.

Incident response discussion

  • Keep it sort of short.
  • Mention some recent lessons.
  • Mention the upcoming Hacks & Hops

[Evan] A topic came up this week when I was talking with an investor. He asked, “what is a vCISO?” The conversation got me thinking, do we just assume that people know what a vCISO is?

[Brad] Still doing the Brad thing.

[Evan] Let’s discuss this and be clear in our definition of a vCISO and what they do. I’d also like to discuss what makes a good vCISO and what makes a bad vCISO.

[Brad] Yep, still doing Brad. Life is good. 😊

vCISO discussion

  • Define vCISO
  • Why do we need vCISOs?
  • What makes a good vCISO?
  • If you’re looking for a vCISO, what should you demand from them?
  • Whatever else seems pertinent to the conversation.

[Evan] Alright, last topic for the show is something that came up in a recent vCISO engagement with a customer. It demonstrates the gaps between what good guys can do when they test something and what the bad guys can do. There’s always a gap. There’s a line that we can’t or won’t cross. Here’s a recent example:

From: Marty Wikle <>

Sent: Sunday, August 25, 2019 9:46:59 PM

To: REDACTEDNAME <> Subject: Respond ASAP

Someone ask me to kill you. For your information I am not sending this message with my email address and internet service provider just in case you want to proof smart and stubborn..any ways I like someone like that!because I will be so happy to put a bullet on your skull..My boys have been watching your steps for few days.

I am giving you a chance to live simply because my oracle show me that you dont have a hand in what you were accused of

You are to pay me $10,000 and I shall terminate the operation,after that I will give you the info of the person that wants you dead

You can call the authority and have them do patrol in your area 24/7 that didn’t stop me from hunting you and your love ones down.We are invisible!!

Reply to this email addresse:

[Evan] This email demonstrates a gap between what we can test as the good guys and what the bad guys do. This gap will always exist because we play by rules and the bad guys don’t care.

[Brad] Still doing Brad…

Short discussion

[Evan] Alright, let’s wrap this thing up with some news.


Here’s our news for this week:


More great episodes to come.

If you’re the social type, socialize with us on Twitter, I’m @evanfrancen and Brad’s @BradNigh.

Talk to you all again next week!

Speaking “Human”: An Open Letter to Security Professionals on a Basic Approach to the Cyber Security Gap

A guest post by Ryan Cloutier. For more information about Ryan, see his profile page.

Most people find the topic of cyber-information security boring, if they have even heard of it at all. The primary cause for this is that digital citizens do not view cyber-information security or their “digital life” as being real or even directly impactful to their own physical life and personal safety. I believe this is due to how we as security professionals have discussed the topic of cyber-info security to non-tech savvy populations.

We might as well be speaking Klingon when we approach a general population with convoluted technical jargon to educate on cyber security.

A favorite quote I heard once from a curmudgeon man after advising him “don’t click the link” was “Don’t click the link?! Listen asshole the whole internet is links!” I laughed but came to the realization that he wasn’t wrong and I then came to understand these three points:

1. We (Security Professionals) are the problem not the user.

We don’t have to go on like this. We can be the change. When educating anyone on cyber awareness, we can use better analogies and real world examples to describe the risk and issues with the behavior we want to see changed. For example, consider the awful security awareness training we must sit through once a year at work or when we get phished by the IT department and then must retake said awful training – it is viewed as a work issue and therefore only applies to the workplace.

2. Focusing only on cyber awareness in the workplace prevents meaningful behavior change. 

If you have the fortune as a Security Professional of managing to get behavior change in the workplace more often than not it is left at the workplace and forgotten about when they go home. However, if we change the conversation to focus on cyber security as a basic life skill, as a fundamental part of our daily physical life then we begin to see change. Today in 2019, most of the connected world uses their smart phone to conduct a large portion of their everyday life from communicating with their loved ones, to banking, shopping, learning, news, entertainment, dating, and so on. 

3. The world has changed but we have not changed with it or adapted our behavior to match. 

We are a society that has not changed our life skills to reflect our new “Digital Life” so when speaking to and training your clients please use relatable examples and common language. Realize that your audience may not be versed in technology nor are they all IT Professionals and as such you need to take the extra time to make it real and relatable. Once you apply this “Make it Real” approach you will see meaningful behavior change and you will have the added benefit of not only making your organization safer and more secure but you will have made the world and a new generation of humans safer and more secure. So I ask you fellow IT security and privacy professionals to please speak human and take the time to break it down. 

Join me in this mission to help make the world a better, safer and more secure place. 

THINGS you might consider adding: 

  • Take the same approach to educating about cyber security that you do when your uncle asks you to describe your job at the Thanksgiving dinner table. 
  • Take stock in what your closest non-technical friends and family don’t understand about cyber security – use this as your baseline to further craft your message into more relatable examples. 
  • Make it real – use examples from your every day life and inject humor into life lessons that will forever change the actions and behaviors of a generation that desperately needs these digital tools. 
  • Commit to spending time educating others outside of your professional work to not only evangelize security in the professional world but in every day activity- volunteer at schools, senior centers, and non-profits which are the unfortunate prime targets of cyber crime and scams. Use these interactions to further craft your message to be inclusive and targeted. 
  • Make an impact by leaving a meeting or speaking engagement with a line of people ready to come up and tell you their story – not leaving with a notebook of acronyms and confusion as they decide “cyber security is too technical for me to make changes in my daily life” 


The UNSECURITY Podcast – Episode 42 Show Notes

Son of a …! Back to being a day late with the show notes. Day jobs get in the way sometimes.

Did you catch last week’s show? Listen to it here.

I won’t bore you (much) with the details, most of my week was spent on SecurityStudio:

  • Our first Board of Director’s meeting was last Friday (8/16), lots to do and talk about, but worthy of it’s own post/article. We’ve put together a great board.
  • Financial projections, modeling, etc. Not my strongest suit, for sure. I’m a security guy who became a business guy, not the other way around.
  • Drafting documentation for SecurityStudio’s platform and products. I guess you can never have too much documentation.
  • Investor meetings and pitches. Raising capital is a crazy experience for someone like me. Learning a whole new side of business.
  • Collaboration with some really cool people.

The entire SecurityStudio experience has been a crazy one. Crazy good some days and crazy challenging other days.

FRSecure is rocking along. Only a few meetings for me here and some very high level support for another incident response.

Overall, good things! Let’s get to the show notes, shall we? Brad’s leading and we have another returning special guest.

SHOW NOTES – Episode 42

Date: Monday, August 26th, 2019

Show Topics:

Our topics this week:

  • More Incident Response(s)
  • Seriously what is going on with all these Incident Responses?
  • Hey, Christophe is back!
  • Industry News

[Brad] – Hi everybody, and welcome to another episode of the UNSECURITY Podcast! This is episode 42, and I’m Brad Nigh, your host. Joining me today is my good friend, Evan Francen. Good Morning Evan.

[Evan] Evan responds with Evanisms

[Brad] We have a jam-packed show this week! If you’ve seen the show notes on Evan’s blog, you know how much we’re planning to get through! Let’s start by talking about what we’ve been busy with, then I’ll share my crazy week. Evan, what’s your week been like?

[Evan] Hopefully has good things to recap from the last week.

[Brad] (literally copied this from last week because, well it’s true) More incidents this week. If this keeps up, we might have to dedicate an entire podcast to incident response! Sheesh.

Incident response discussion

[Evan] We like responding to incidents because we love helping people. We hate responding to incidents because it means someone is (maybe) in trouble. We’ll see if we make it a week without another one.

Active IR discussion and transition into discussion with Christophe Foulon.

[Brad] Christophe, welcome back to the show. How’s things on the East Coast this morning?

[Christophe] Says what Christophe says…

[Brad] So, it’s been a few months since you were on with us. What’s new with you? What are you working on?

Discussion with Christophe

About his current projects and what he’s been up to. Will certainly be a good discussion! We’ll see where it goes.

We have Christophe for 1/2 hour before he needs to get back to work, so he may/may not stick around for news.

[Brad] Alright, we’d better get to some news. We might not get through all of it, but we’ll get through some of it.


Here’s our news for this week:


[Brad] – Dang, that was a helluva lot of stuff to fit into one show! That’s how it is. Big thanks for Christophe for joining us. He’s a great ally in the industry. Thanks Evan, and a special thank you to our listeners. The show grows each and every week, and we love your feedback. You can reach the us on the show by email at

Evan’s already got a great show planned for next week, so keep up with us. If you’re the social type, socialize with us on Twitter, Evan’s @evanfrancen  and I’m @BradNigh.

Talk to you all again next week!

The UNSECURITY Podcast – Episode 41 Show Notes

Happy Friday! Time for show notes, and I’m actually early with the notes this time.

We’re humbled and grateful for the growth of the UNSECURITY Podcast audience. Every week breaks a new record, in terms of listeners and downloads. Thank you for spending time with us!

Great show planned this week, with some healthy controversy. I won’t put the controversial stuff in these notes, so you’ll have to listen to get the skinny.

Hope you had a great week! Here’s some quick highlights from us:

  • Our very own Team Ambush came back from Def Con after capturing 2nd place in the warl0ck gam3z capture the flag (CTF)! Helluva accomplishment for an awesome and incredibly skilled group! We’re VERY proud of them and their accomplishment. This is the 2nd year in a row that they’ve captured 2nd place at Def Con. We’ll be talking with the leader of FRSecure’s Technical Services Team, and member of Team Ambush on this show!
  • Speaking of Team Ambush, they were featured on KARE 11 news (one of the largest in Minneapolis/St. Paul) on Wednesday night during prime time. A link to the feature is here;
  • Minnetonka School District is one of the largest and arguably the best school district in Minnesota. I had the pleasure of presenting to their faculty and staff on Monday. The title of the talk was Security@Home Security@Work. In the talk, I featured SecurityStudio’s newest product, S2Me. S2Me is a personal information security assessment and it’s free. If you haven’t done so already, go get your S2Score now! We used the results of the assessments to drive conversation about information security. Great discussion! S2Me is a great conversation starter and we’re excited to go where it takes us.
  • I spent the rest of the week fundraising for SecurityStudio. We’re in the middle of seeking our seed round of funding, and it’s a helluva experience for me. I’ve never raised money before, so I’m learning as I go. If you know anybody who’s willing to share wisdom in this area, send them my way (

Things are good. On to show notes, eh?

SHOW NOTES – Episode 41

Date: Monday, August 19th, 2019

Today’s Topics:

Our topics this week:

  • What is S2Me?
  • More Incident Response(s)
  • Def Con with Oscar
  • Industry News

[Evan] – Hi everybody, and welcome to another episode of the UNSECURITY Podcast! This is episode 41, and I’m Evan Francen, your host. If this isn’t your first time listening, you already knew that. Joining me today is my show buddy, Brad Nigh. Care to say “hi” Brad?

[Brad] Brad almost always says “hi” but we’ll see if he read the show notes. Maybe he’ll come up with something unique.

[Evan] We’re excited for today’s show because we have a first time special guest joining us. None other than the infamous Oscar Minks, joining us from his home base in Kentucky. Oscar, wanna say “hi”?

[Oscar] Hi, or something similar.

[Evan] Oscar, you’re the Director of Technical Services at FRSecure, right? Tell our listeners what that job is.

[Oscar] Tells us what he does here.

[Evan] Thank you Oscar, it’s an honor to have you here.

Brief discussion with Oscar

[Evan] OK. Have you guys heard of the S2Me yet?

[Brad][Oscar] Tell the truth.

[Evan] Have you guys got your S2Score yet? Care to share?

Discussion about S2Me and the theories behind it. Maybe a little chat about Minnetonka School District too

[Evan] More incidents this week. If this keeps up, we might have to dedicate an entire podcast to incident response! Sheesh. I’ll tell you about mine, then you tell me about yours Brad.

Incident response discussion

[Evan] We like responding to incidents because we love helping people. We hate responding to incidents because it means someone is (maybe) in trouble. We’ll see if we make it a week without another one.

[Evan] Two weeks ago, we had “Ben” on the show to talk about going to Def Con among other things. Now Def Con is over, and we can talk a little about our team’s experience. Oscar, you were there. Let’s chat.

Def Con discussion

[Evan] Thank you for sharing Oscar. More to come I’m sure. Let’s wrap this up with some news. We’ll cover as much as we’ve got time for. Three stories to start.


Here’s our news for this week:


[Evan] – Again, that’s how it is. Thank you Oscar for joining us. Thank you Brad for being a great partner. Special thank you to our listeners, and especially those of you who give us input and feedback. You can reach the us on the show by email at

If you’d like to be a guest on the show or if you want to nominate someone to be a guest, send us that information too.

As always, you can find me and/or Brad on Twitter. I’m @evanfrancen and Brad’s at @BradNigh. Oscar, do you twit?

Talk to you all again next week!

Snake Oil Won’t Cure Your Security Illness

Part two in a three-part series about the information security industry money grab.


NOTE: I covered some of these issues in my book; Unsecurity: Information Security Is Failing. Breaches Are Epidemic. How Can We Fix This Broken Industry?

In this series, I’ll focus on three types of money grabbers, those

  1. Who will do anything and everything for your money
  2. Those who sell snake oil
  3. Those who will sell you something regardless of it’s effects on your security.

There’s no doubt that the money grab is alive and well in the information security industry. Some companies and people in our industry will do everything they can to get their hands on your money. Some of them should get your money, while others should be put out of business because of their deceptive practices.

Clark Stanley’s Snake Oil

This stuff was amazing. A concoction, or “liniment” as Clark Stanley called it, that will cure just about anything; rheumatism, neuralgia, sciatica, “lame back”, lumbago, “contracted cords”, toothaches, sprains, swelling, etc. I don’t even know what half these ailments are, but I don’t know if I’d care either. This stuff will cure me of ailments I don’t even know I have, and it will protect me from future ailments. If I were alive in the 1890s, I might have bought some of this wonder juice.

When Clark Stanley started peddling his snake oil to the ignorant masses, there was nothing to stop him. There was no regulation to govern the safety and effectiveness of drugs until 1906. Nobody even knew what Mr. Stanley’s wonder-drug was made of until 1916, this was the year that the Bureau of Chemistry (later the Food and Drug Administration-FDA) tested Snake Oil and determined it was made from mineral oil, 1% fatty oil (assumed to be tallow), capsaicin from chili peppers, turpentine, and camphor.

People caught on, the jig was up, and Stanley eventually pled no contest to federal civil charges that were leveled against him.

Information security industry snake oil

There’s snake oil for sale in our industry. Don’t buy it. It doesn’t work (for you).

Thanks in large part to Clark Stanley, the term “snake oil” has become synonymous with products and services that provide little (if any) value, but are promoted as solutions to problems. The term is also used to refer to exaggerated claims made by salespeople.

You’d be naïve to think there aren’t products and services sold in our industry that don’t fit our definition of “snake oil”. There are two types of snake oil being peddled today, the kind that is overtly deceptive and the kind the covertly deceptive. Both are bad, and you need to watch out.

Overtly deceptive

Overtly deceptive snake oil is the kind that comes with claims that are so outrageous, you start to question everything you know about yourself. The claims seem so real, with seemingly genuine evidence, and fancy words, you ask yourself questions like “Could this possibly be true?” “Is everything I’ve known about these things been wrong?” “How could I be so wrong?” “Is my existence a joke?”

No, you’re not wrong. Your existence is not a joke. The claims are crazy.

Here are two recent examples.

World’s First Patented Unhackable Computer Ever

What?! Unhackable? This can’t possibly be true. Can it? Well, if we were to believe Pritam Nath, the CEO of MicrosafeX Company, then yes it is true. If you use your noggin and think about this for a minute, the answer is absolutely NOT! There is no “unhackable” computer. There is no “unhackable” anything. Mr. Nath is selling snake oil, and thankfully the jig was up before people fell for it.

You should read his claims on his Kickstarter fundraising page. The claims are laughable if they weren’t so sad and patently false. There were 36 reported “backers” of Mr. Nath’s snake oil before the campaign was cancelled. I’m guessing most of these people were in it for the fun, not because they took this thing seriously.

Time AI

Sounds cool. What is it?

AI is sexy, but if AI doesn’t get your juices flowing, how about “quasi-prime numbers”, “infinite wave conjugations,” and “non-factor based dynamic encryption and innovative new developments in AI”?

SOLD! Lots a big words solving cool problems that I don’t understand. Must be cutting edge stuff.

The company peddling this Time AI thingy is Crown Sterling out of Newport Beach, California. I’d never even heard of these guys before last week.

Last week, at Black Hat, Robert Edward Grant, the company’s Founder, Chairman, and CEO gave a talk titled “The 2019 Discovery of Quasi-Prime Numbers: What Does This Mean For Encryption?“. The talk was so overtly snake oilish that it prompted very strong reactions (outrage) from some people who were there.

Dan Guido, the CEO of Trail of Bits stood up during Mr. Grant’s snake oil pitch and shouted “Get off the stage, you shouldn’t be here!” “You should be ashamed of yourself!” Ballsy.

Here’s a video clip of the exchange.

Jean-Philippe Aumasson is a serious crypto guy, and the author of the book Serious Cryptography.

There was enough of an uproar to force changes at Black Hat, including removal of references to the talk from the conference website and a promise of better vetting of sponsored talks in the future.

More coverage:

These are two examples of obvious and overtly deceptive snake oil. There’s also the less obvious, covertly deceptive variety.

Covertly deceptive

Covertly deceptive snake oil is hard for the inexperienced and/or lazy security professional to identify. It’s the sort of snake oil where a salesperson or company claims that their product does something that it doesn’t or that it will solve a problem, but it won’t. This snake oil is hard to identify because you won’t know unless you know.

One tell for covertly deceptive snake oil is the prominent use of sexy buzzwords. Common sexy buzzwords/phrases include:

  • Artificial intelligence or “AI”
  • Blockchain
  • Digital transformation
  • Big data
  • Machine learning or “ML”
  • Nextgen
  • Data-driven

If someone uses a buzzword or phrase that you don’t understand, go find out what it means. Don’t just sit there and nod your head like you know. Discounting buzzwords and phrases won’t always work though. There are legitimate companies and products in the market using sexy buzzwords, but work as promised.

The key to protecting against covertly deceptive snake oil is to follow the advice in the closing (below); research, educate, and/or ask. Don’t ever rely solely on the opinions and research provided by the company or salesperson who’s selling, it’s biased.

Buyer beware

It’s you who makes buying decisions for you. No pressure, but every dollar you spend on security is one less dollar your organization can spend on fulfilling its mission, so you should get it right.

Don’t ever buy anything without doing one (or all three) of the following:

  1. Conduct in-depth research into the product and how it works.
  2. Educate yourself on the technology the product claims to use.
  3. Ask an unbiased expert for his/her opinion.

If we all made good purchasing decisions, the snake oil will dry up. You will need to do more work, but in the end it will save you.

The UNSECURITY Podcast – Episode 40 Show Notes

Another week in the books (almost). Speaking of books, I’m working on one with two more in the works. So much writing to do, and not enough time! I’m sure that lack of time is not a problem that’s unique to me. Time is precious, and nobody’s got enough of it.

In case you missed it, this week was “Hacker Summer Camp” in Las Vegas. Thousands of information security people descended upon Sin City this week for Black Hat, BSides Las Vegas, and DEF CON. These are three of the best known and well-attended conferences in our industry. David (aka “System Overlord”) writes a good summary, you can read it here.

Instead of going to Hacker Summer Camp, I took this week to get away. A few people were surprised that I wasn’t going, but to be honest, it’s not really my jam. It’s too much noise, too much BS, too much drinking, and too flashy for me. Maybe it’s just a different stage of life for me now. Some people thrive on being where the action is; I’m just not one of them. To each his/her own.

We sent 10 people from FRSecure, people with more self-control.

While Black Hat was kicking off, I took off to Duluth, MN and the North Shore for a few days. Did some catch-up work and some writing. It was good soul time.

This slideshow requires JavaScript.

Alright back to the grind. In the office this morning, putting together episode 40’s show notes, and getting face time with some of my favorite people. Hopefully, you enjoyed last week’s show, with the return of “Ben”. As I write this, Ben is neck deep with FRSecure’s Team Ambush competing (and winning?) in their DEF CON CTF.

This week, Brad’s back!

On to the show notes…

SHOW NOTES – Episode 40

Date: Monday, August 12th, 2019

Today’s Topics:

Our topics this week:

  • Catching up; Brad’s Back
  • More Incident Response(s)
  • Hacks & Hops
  • warl0ck gam3z
  • Industry News

[Brad] – Welcome to episode 40 of the UNSECURITY Podcast! My name is Brad Nigh, and I’m your host this week. I’ve had a couple of weeks off from the podcast, but it’s good to be back! Joining me as co-host this week is Evan Francen. Hi Evan.

[Evan] Hi Brad. Welcome back!

Catching up (a little)

[Brad] So, jumping right back into things this week. We received a couple of interesting incident response calls. I’d like to talk about them, how we handle them, and then we’ll segue into Hacks & Hops and a great tip/question we received from one of our listeners this week.

[Evan] Sounds good. Let’s do it.

Incident response discussion

Discuss real security incidents that we’re working on/investigating.

[Brad] Incident response is the theme for our next Hacks & Hops event coming up next month at US Bank Stadium.

[Evan] Yep. We’ve got an amazing event planned with an all-star panel.

[Brad] Who’s on the panel? Tell me about them.

[Evan] We have three panelists joining us, and I’ll be moderating. All three panelists are people that I have deep respect for; Jadee Hanson, Mark Lanterman, and Chris Roberts.

  • Jadee is the CISO at Code42, and she’s done an amazing job building a world-class security team. She’ll bring the perspective of an expert security leader. Jadee’s bio is here.
  • Mark is the CTO at Computer Forensic Services. He’s one of the best incident investigators I know, and he’s got some amazing stories to share. He’ll bring the perspective of an expert security investigator. Mark’s bio is here.
  • Chris is Chris. Two things I like most about Chris is his truth and his style. He scares most people by telling them the truth, he’s got some incredible stories, and he’s blunt. Chris will bring the perspective of a hacker. Chris’ bio is here.

All in all, this is an incredible panel. I’m pumped!

Hacks & Hops discussion

[Brad] Since we’re on the topic of incident response, let’s address a question that came in from one of our listeners this week. This is from Jeff. Jeff asks:

Incident Response – what is minutia and what is a real incident?  It seems contradictory to say that some companies may not use their IR plan in a year – and to also say that every suspected attack, malware, scan, etc. is an incident.

Let’s tackle this quick.

[Brad] Alright, moving on. Last week was “Hacker Summer Camp” in Vegas. Neither you nor I went this year, mainly because of workloads and other priorities. We did send ten (10) people from FRSecure though, and eight of them belong to a group that calls themselves “Team Ambush”. These guys competed in the warl0ck gam3z CTF at DEF CON. Two years ago, they took 3rd place. Last year, they took 2nd place. This year they claimed that they were all in!

How’d they do.

Discuss warl0ck gam3z and Team Ambush

[Brad] OK. I’ve only got one news item to discuss this week. I think one is enough because of it’s significance. Let’s talk about the security incident(s) at AT&T that were announced recently.



[Brad] – There you go, that’s how it is. It’s great to be back. Thank you Evan, and a special thank you to our listeners. We’re sort of blown away by the number of people who listen to our podcast each week, and we love getting your feedback. Please keep it coming. You can reach the us on the show by email at

If you’d like to be a guest on the show or if you want to nominate someone to be a guest, send us that information too.

As always, you can find me and Evan on Twitter. I’m @BradNigh and Evan’s at @evanfrancen. Talk to you all again next week!

Beware of People Who Do Everything

Part one in a three-part series about the information security industry money grab.


NOTE: I covered some of these issues in my book; Unsecurity: Information Security Is Failing. Breaches Are Epidemic. How Can We Fix This Broken Industry?

In this series, I’ll focus on three types of money grabbers:

  1. Those who will do anything and everything for your money,
  2. Those who sell snake oil, and
  3. Those who will sell you something regardless of its effects on your security.

Sometimes the money grabbers grab your money intentionally, but rarely do they do it with malicious intent.

There’s no doubt that the money grab is alive and well in the information security industry. We’re in the midst of the Cybersecurity gold rush, and there are thousands of companies fighting for their piece of your pie.

Cybersecurity gold rush

First, a quick comparison between the famous California gold rush and our cybersecurity gold rush.

The California gold rush looked like this: $10 million in 1849, $41 million in 1850, $75 million in 1851, and $81 million in 1852 (peak). After 1852, the rush gradually declined until 1857, then leveled to about $45 million per year.

The cybersecurity gold rush looks like this: $3.5 billion in 2004, $114 billion in 2018, $124 billion in 2019, and $170 billion by 2022. We haven’t exactly leveled off yet, but that day will come.

The truth about the cybersecurity gold rush; if you’re not one who’s making money, you’re probably one who’s spending it.

Spending well or not

Ask yourself these questions:

  • How confident am I that I’m spending my information security dollars wisely?
  • Am I getting the most value out of every dollar I spend?
  • Where do I get answers?

If you seek answers from a money grabber, you’re in for a rude awakening. Maybe not immediately, but soon. Money grabbers are biased, they’ll give you answers with a bias to sell you something.

So, how can you tell a money grabber from a trusted source of good information? It starts with understanding who the players are in our industry.

The Players

There are four players (or roles) in our industry; manufacturers, vendors, partners, and practitioners. Each of the players serve a very important role in making our industry function, and one player cannot effectively exist without the others. Don’t fall into the trap of thinking that one player is any better than another, they’re all critical.

Let’s break them down.

Security Manufacturers

Security manufacturers provide innovative hardware and/or software designed to solve real-world information security problems. They are critical to the information security industry because they make the tools we all use to secure ourselves.

Security manufacturers have three responsibilities to our industry:

  1. Understand the problem they’re trying to solve enough to make an effective hardware and/or software solution.
  2. Make an effective hardware and/or software solution that solves a problem.
  3. Sell the hardware and/or software solution to people in order to make money.

The manufacturer obviously needs to make money in order to satisfy investors and stakeholders. They’ll also need the capital to make more products. Stop the cycle and the manufacturer dies.

All fine and dandy.

Problems arise when a manufacturer attempts to play other roles, like giving you non-product related advice. It only seems logical that the advice you’d receive would be biased by one of their primary motivations which is to sell you their products. A manufacturer wants to sell you things because they want your money. What they sell you might solve a problem, but if it doesn’t, that’s ultimately your problem. The worst practice is convincing you that you have a problem that in reality doesn’t exist.

Even if a manufacturer solves a problem for you, you need to ask yourself if it was the right problem to solve. Was the risk significant enough to warrant a reallocation of resources (personnel, time, money, etc.)?

A manufacturer is probably not the best place to ask your questions about where you should spend your next information security dollar. They’ll certainly have an answer, but it won’t be unbiased, and it may not be in your best interest.

Security Vendors

Security vendors are an interesting bunch. They don’t make products, they sell them. We need vendors though. We need them because they’re closer to our problems than most manufacturers, and they know products better than partners (up next). They give manufacturers a distribution and support channel, so the manufacturer can go back to what they do best, making things.

Vendors represent products made by the manufacturers, and probably provide support for the products too. Vendors are usually specialists in the products they represent and are the “go to” people for making sure your products operate the way their intended to operate.

Advice from a vendor might be closer to the truth, but it will still be significantly biased. Vendors get paid for selling products, and they only represent their suite of products. Vendors, like manufacturers, want to sell you something. Ultimately, they want your money. Solving problems will be limited to the products they carry and advice probably won’t take other creative possibilities into account. Security vendors usually don’t innovate much and are more likely to go with whatever the herd is doing.

Security vendors are the best place to go for advice about a specific suite of products, but are not the best place to go for unbiased expertise.

Security Partners

A true security partner is a consultant without bias, but someone without bias is a pipe dream.  The truth is, nobody is without bias, but good partners do their best to be a trusted advisor to clients with as little bias as possible. Good security partners who understand the importance of their role (in the industry and to their clients) are product agnostic. They strive to make recommendations based on what’s best for the client.

Partners also want your money, but they won’t make money if they betray your trust. Trust is what keeps them honest.

Advice from a security partner must be as unbiased and as objective as possible. Security partners are good at creating or finding innovative solutions to problems because they’re not tied to any specific product or suite of products. One problem with a security partner is they may not have the deep knowledge about any one particular product like a vendor or manufacturer may have. Partners try to compensate for this by establishing working (not selling) relationships with vendors and manufacturers.

Security partners are the best place to go for advice about solving your information security problems with as little bias as possible. A security partner would be the best place to start for answers to most information security questions.

Security Practitioners

The hard-working security people who bust their asses everyday to make their workplace and the world a better place. Security practitioners make (or influence) buying decisions and they’re the ones who live with the fruits (or consequences) of their decisions. Most security practitioners don’t have time to research everything and need others to assist them in fulfilling their own personal mission.

Security practitioners deserve, and should demand respect at all times.

OK, now you know the roles/players. Where’s the money grab?

Beware of People Who Do Everything

I’m speaking to the security practitioners now.

Wouldn’t it be great if you could go one place for everything? A one-stop shop. Seems like a great idea and a real benefit, but it’s ignorant to think that there wouldn’t be an undercurrent of bias that could hurt you and your organization.

  • A manufacturer is biased to sell you their products.
  • A vendor is biased to sell you something out of their suite of products.
  • A partner couldn’t even sell you products if they wanted to. A partner cannot be a one-stop shop even if they want to be.

If you’re comfortable with the bias and you’re comfortable with the inevitable waste of resources, you’ll be comfortable with the one-stop shop approach. It’s lazy and wasteful, but it’s your security program.

If you’re not comfortable with the bias and wasted resources, you might have a little more work cut out for you. The right thing is to use each player for what they were designed for. A manufacturer for buying their products, a vendor for buying from their suite of products and product support, and a partner for the best advice.

Problems come when a player doesn’t understand their own role. When a vendor tries to be a partner too or when a partner tries to be a vendor too. Worse yet is the player who tries to be manufacturer, vendor, and partner. If you didn’t know any better, the “we do everything” player has you by the neck.

In my experience, the most common offender of their role, almost like an identity problem, is a vendor. Many vendors grew their business through other means, maybe selling printers and copiers, maybe doing information technology (IT) work, or maybe reselling networking equipment. The vendor resells things, but as a matter of survival and as margins decrease, they look for new streams of revenue. One common stream of revenue is security consulting services where the market is relatively immature and where a vendor can realize more significant margins.

Two problems with the vendor who plays partner:

  1. The bias problem. I’ve already covered this, but it’s a significant problem. I’ve witnessed many occasions where a vendor has sold things to a client that were clearly biased by the fact that the vendor sells those products. It’s only natural that a vendor would sell products, but it’s the practitioner who pays the price.
  2. Good at some things, but an expert in no things. Nobody can be the best at everything, you can only be the best at one thing or maybe a few things. A vendor who sells copiers, installs Cisco networks, builds data centers, and recycles old equipment, is not likely to be an expert in information security. Information security requires a specialized skill set, and you will get what you pay for. Unfortunately, it’s the practitioner again who pays the price.

Vendors aren’t bad. Partners aren’t bad. Manufacturers aren’t bad. Things can get bad when one player tries to play multiple roles. These multi-role players do it because it’s in their best interest, not necessarily because it’s in your best interest.

Things can get bad for you when you play into a multi-role player’s hand. You wouldn’t know the difference unless you were paying attention. Spend every information security dollar like it’s precious, because it is. One wasted dollar is one less dollar to spend on other more productive and enjoyable things.

Before I close, and one last time, there is nothing wrong with manufacturers, vendors, or partners. They’re all critical. It just helps if you know who they are, and better yet, if they know who they are.

The UNSECURITY Podcast – Episode 39 Show Notes

HAPPY FRIDAY! You made it through another week. Did you survive or did you thrive? Hmm. Something to think about, I suppose.

Good week here for me, the folks at FRSecure and the folks at SecurityStudio. Most weeks are good weeks really.

I was in town all week, but not in the office too much. Came in for meetings, then excused myself for more writing. Most of my days are consumed by writing lately. Writing a few blog posts, a few articles, and working on the upcoming book.

I’ll leave it at that for now. Many exciting things to share, but we’ll be patient and let them take a little more shape before sharing.

Did you catch episode 38 of the UNSECURITY Podcast? John Harmon, the president of SecurityStudio was in studio and we had a great chat. John and I are working well and working closely together. It’s a blast!

This week’s show, episode 39, is a real treat. “Ben” comes back in studio to give us the lowdown on what he’s been up to. I’m excited for you to hear what he’s got to say. This show is released on Monday (8/5), so be sure to look for it!

On to the show notes…

SHOW NOTES – Episode 39

Date: Monday, August 5th, 2019

Today’s Topics:

Our topics for the week include:

  • Conversation with “Ben”
    • Research
    • Responsible Disclosure
    • Social Engineering (SE) Things
    • Team Ambush
    • DEF CON
  • Industry News

[Evan] – Hello listeners, and welcome to episode 39 of the UNSECURITY Podcast. My name, for those of you who don’t know, if Evan Francen. I’m your host for today’s show, again. Scheduling stuff for security people is always a pain in the ass, and this week is no different. We’re recording this show on Friday because I’m out of the office next week. This is still Brad’s vacation, so he’s out of hand for hosting. All this means that I get to host again! That’s cool, right?!

Brad will be back next week, and he’ll have a great show planned I’m sure.

Now, you don’t want to sit there and listen to this voice for an entire show, so I invited someone last minute to join me. I found “Ben”! Want to say hi to the listeners Ben?

[Ben] Ben does Ben.

[Evan] Ben, thank you for agreeing to join me, especially last minute like this.

[Ben] Ben does Ben.

[Evan] Ben’s not your real name, right? So why do we call you “Ben”?

[Ben] Ben does Ben.

[Evan] You were here back in episode 14 (February 11). It was a great talk then, and this one will certainly be as good or better. Ben, you live a damn cool life, at least as it goes for security people. You cool if we talk about some of the things going on with you?

[Ben] Ben does Ben.

Conversation with “Ben”

Topics to discuss with Ben include:

  • Research
  • Responsible Disclosure
  • Social Engineering (SE) Things
  • Team Ambush

[Evan] See, I told you. Ben does cool stuff, and a lot of it! We could have talked for hours, but we can’t do that here. Let’s close with some news.

Industry News

Plenty of news this week, but arguably the most talked about is the Capital One breach. Instead of what’s in your wallet, now the joke is “who’s” in your wallet. Seriously though, this was big news this week.

Here’s our news to discuss in this week’s show.


[Evan] – So, there you go. That’s how it is. Ben, a huge thank you for joining me this week. Best of luck to you and all of Team Ambush this week at DEF CON. You’re going to have a great time and I can’t wait to hear how things went. Also, as always, thank you to our listeners. The podcast continues to grow and we’re grateful. Keep the awesome feedback coming, send it to If you give us something real cool, we’ll mention it. Without your approval of course. Wait. That’s not right. I mean WITH your approval.

If you’d like to be a guest on the show or if you want to nominate someone to be a guest, send us that information too.

Ben, how can people reach out to you? Or do you even want people to reach out to you?

[Ben] People can reach me through Twitter. My Twitter handle is @M1ndFl4y. I don’t post much, but you can reach me through a DM there.

[Evan] OK. Thanks again. Find us on Twitter for daily chatter. I’m @evanfrancen and Brad’s @BradNigh. Have another great week everybody!

Robocalls Are Dumb, You’re Not

Your cell phone buzzes, you look down and see “No Caller ID”, “Unknown” or maybe a weird number you don’t recognize. Do you answer, or do you just let the call go to voicemail?

Some people, myself included, will let these calls go to voicemail. It’s not a bad idea to ignore calls from numbers you don’t recognize.

Some people answer, they listen, and they follow the caller’s instructions, even if the caller is nothing more than a machine.

So, let’s say you’re one of the people who answers. The machine with a human voice tells you some urgent and potentially bad news. The machine tells you if you don’t want things to get worse, you’d better “press one” or call the phone number provided. Your mind starts to race, and you begin this internal dialog with yourself:

Oh crap!

Wait. Maybe this is a scam.

But what if it’s not? What if I really am in trouble?

It couldn’t hurt to press one, could it?

Ah hell, I can’t chance it. I don’t need any trouble. I should take care of this right now.

I’ve got to find out what’s going on.

After pressing one, a man, a real one this time, gets on the phone and tells you it was smart for you to take this seriously. The conversation goes something like this:

Man: This is John, from the Department of Social Security Administration. May I ask who’s on the line?

You: This is Jane Doe, and I got this call that something is wrong or something about criminal charges.

Man: Yes, thank God you took this matter seriously ma’am.

You: So, what happened?

Man: It looks like your identity is being used to commit felonious acts. These acts are tied to you, and you will be charged with a crime if you don’t act.

You: What do I need to do?

Man: We need to file your paperwork right away to stop the charges. We can mail the paperwork in, but I fear that the courts won’t get it in time. Our other option is to file your paperwork over the phone. This is the best way to make sure this matter gets squared away fast, before you get hauled into court.

You: OK, what do you need?

Man: We need to verify your identity.

You agree, so he proceeds to ask you questions about you. He asks for your name, your address, your age, where you work, and of course, your Social Security number. You give him everything he asks for, and the call ends with some mysterious, but official sounding close.

You’ve been scammed. Sometimes the crooks are targeting your identity (like this example), and sometimes they’re targeting your money directly. Sometime both.

Robocalls are dumb, but they must be working, at least some of the time. There are real victims, or the scammers wouldn’t waste their time. In 2018, there were more than 26 billion robocalls placed to phones in the United States, a 46% year-over-year increased volume. (Hiya Robocall Radar 2018 Report)

This got me thinking, why? The reasons are simple, because it’s cheap for the scammers and it works. People must be falling for these dumb scams. Attackers wouldn’t go through the trouble if these scams weren’t effective, right?

People take the bait, either through ignorance or through a moment of weakness.

Just this week, the FCC adopted new rules to combat robocalls. You might think, “great, let’s shut these sumbiches down!“. Hold your enthusiasm just a minute. Do you really expect the Feds to protect you? Actions by the FCC might help curb the problem, but at the end of the day, this falls on you. Only you can prevent yourself from being scammed.

It’s baffling to think that someone would fall for a robocall scam, but rather than sitting here shaking my head, let’s go through some examples and try to help someone.

Call Number One – Social Security Number Suspension

Here’s the text of the call:

We found some suspicious activity, so if you want to know about this case just press one thank you. This call is from the Department of Social Security Administration. The reason you have received this phone call from our department is to inform you that we just suspend your Social Security number because we found some suspicious activity, so if you want to know about this case just press one thank you.

The message continues and repeats.

Here’s the audio:

Here’s the skinny.

  1. You will NEVER receive a call from the “Department of Social Security Administration”. Besides, the actual name of the agency is just “Social Security Administration” not the “Department of Social Security Administration”.
  2. The Social Security Administration DOES NOT monitor your number for “suspicious activity”.
  3. The Social Security Administration DOES NOT suspend your Social Security number.


Call Number Two – Legal Consequences

Here’s the text of the call:

Social Security number the (unintelligible) received this message, you need to get back to us to avoid legal consequences. To connect call immediately, press one.

The message ends.

Here’s the audio:

Here’s the skinny on this one.

I don’t even know what the hell the message says really. All I know is that I don’t like legal consequences. Guessing you don’t either. The fact is, you are not facing any legal consequences, and even if you were you’d be served in writing and probably in person. Nobody calls you to tell you that you’re going to suffer legal consequences on a voicemail, at least nobody who’s legitimate.


Call Number Three – Legal Proceedings

Here’s the text of the call:

legal enforcement action filed on your Social Security number for criminal activities. So, when you get this message, kindly (unintelligible) as soon as possible on our number that is 210-361-9633 before we begin with the legal proceedings. Thank you.

Here’s the audio:

The skinny.

A “legal enforcement action filed on your Social Security number for criminal activities”?! This is so preposterous, I’m having trouble thinking of something to write in response. You will NOT receive a recorded call telling you of impending legal proceedings because of criminal activities using your Social Security number. If there were such a crazy thing, you’d be notified in person and in writing.

DO NOT CALL THEM BACK. (Side note: I did. Got a busy signal, so I’m guessing they already got taken down by the carrier/law enforcement).

Call Number Four – Chinese

The text of this call is all in Chinese, and I don’t speak Chinese. So, I did some translation work*. Here’s what I think it says:

这里是中国领事馆文件通知您有一封重要文件尚未领取中有任何疑问请按铃 查询

in English:

Here is the Chinese Consulate Document to inform you that there is an important document that has not been received. Please feel free to ring your query.

Here’s the audio:

The skinny.

I don’t speak or understand Chinese, so there was no real chance of this one working on me. This is an automated caller though, and there are an estimated 2.9 million people in the United States who do speak Chinese and as many as 1.2 billion people worldwide who also speak Chinese.

One joy of the robocall for scammers is they can reach thousands of phones automatically. It’s no skin off their back if they reach someone who doesn’t understand. Eventually, they will.

Not sure how effective this sort of call is with the Chinese speaking community, but like I said earlier, they wouldn’t do it if it didn’t work (at all).

(Another side note: Now that I think a little more, maybe this last one wasn’t a scam. My wife is travelling to China next month. WAIT. See, here’s rationalization. Irrational rationalization. No, it’s a scam and I will ignore it.)


The first tip is the most important one, so I’m going to shout it. Ready?


You get that? I’m going to shout it again. This time I want you to really think about it.


Communication channels include phone calls, emails, popups, text messages, and even in-person. If you initiate the phone call, not at the prompting of someone else giving you the phone number to call, you are most of the way there in protecting yourself from scams.

2. Ignore phone calls that originate from phone numbers you don’t recognize. Ignore them, and get on with your day. If it’s important, they’ll leave a message.

3. Be skeptical. You don’t need to be paranoid, but be skeptical.

4. Slow down. Don’t react without giving your mind time to think and process what’s going on. Taking 10 minutes to think things through will not put you in danger, but just the opposite.

5. Ask someone you trust. If you’re not sure whether a phone call or message is legit, ask someone. They’re not tied to the events emotionally in the same way you are. Don’t be embarrassed to ask questions.

There you have it. You can probably come up with some additional tips along the way, but these are the basics. Master the basics people.