Cyber Security Threat Actions This Week (podcast)

If your organization is not using the MITRE ATT&CK framework yet, it’s time to start. Katie Nickels from MITRE, Travis Farral from Anomali and I join host David Senf from Cyverity to talk about ATT&CK tactics, techniques and tools. You can listen to this 45-minute podcast here.  We discuss what ATT&CK is and isn’t, how it can be used to help defenders learn more about how exploits work and how to become better at protecting their enterprises, what some of the third-party tools (such as Mitre’s own Caldera shown here) that leverage ATT&CK and what are some of the common scenarios that this framework can be used for.

I did two stories for CSOonline about ATT&CK earlier this year:

 

FIR B2B PODCAST #100: THE MOST MEMORABLE MOMENTS OF OUR DECADES IN TECH JOURNALISM

This week we take a trip down memory lane to discuss the highlights of our 60-some odd collective years of working as B2B journalists in the technology field. There are some great stories, such as Meeting Bill Gates (Paul at a press junket, David at an industry conference) and working with Greg Gianforte, now a member of Congress from Montana after making several fortunes starting technology businesses. Being a tech journalist has its risks: Charles Wang, when he was chairman of Computer Associates, campaigned to get Paul fired from Computerworld, but the two later became friends. David’s parody of Miss Manners got him a cease-and-desist letter from the columnist’s lawyers. We both recall what the introduction of the web did for our industry and our world back in 1994, and how quickly the publishing market changed as a result. David recalls with fondness his interaction with Bob Metcalfe, the inventor of Ethernet and now a professor at UT/Austin.

David remembers writing about a skunk works project from IBM to use spreadsheets as a front-end to their mainframe databases, and noted how the sole programmer behind the project, Oleg Vishnepolsky, later said his career was changed by the articles. Paul recalls the “old IBM,” which once IBM mistakenly put out a press release and then disavowed what it said.

We have lots of other memories, and hope you enjoy this episode.

FIR B2B Podcast #99: Why Was Intel’s CEO Really Fired?

The firing of Intel CEO Brian Krzanich last week over a single sexual harassment claim shocked some people because the scope of the crime seemed out of proportion to the punishment. This articleby Agility PR makes the case that one harassment claim can do more damage to your brand than a charge of financial fraud. The Register suggests that the reason for Krzanich’s dismissal goes deeper, and if that’s true, it wouldn’t reflect well on Intel. Companies need to navigate these waters with care, making sure they are prepared for a harassment charge, rather than hoping for the best.

What you ask Google influences the results you get. That’s probably not news, but it has interesting implications when you consider the trust people put in search engines to deliver the truth. Francesca Tripodi surveyed two Republican groups in Virginia — a women’s group and a college group — during their 2017 gubernatorial election. Just by varying one word in the search box, such as using  “NFL ratings up” vs. “NFL ratings down,” proved to deliver two very different result sets. We discuss what marketers can learn from the exercise and how to craft better keyword collections and hashtags for your future campaigns.

You can listen to our podcast here.

FIR B2B podcast #98: WHY DOESN’T MARKETING ATTRACT MORE RECENT GRADS?

Why isn’t marketing attracting more college grads? That’s the topic Paul Gillin and I explore this week, starting with the results of a study commissioned by Marketing Week earlier this year which  found that just 3% of undergraduates think marketing offers them the best career opportunities.

The publication held a seminar to try to explore ways to better engage Gen Z, and we have several thoughts on the matter too. Colleges need to have more focused marketing programs, and businesses need to show that a wide range of skills and talents can be put to best use with marketing programs. Certainly there are obstacles, such as CEOs who think they are good marketers when they aren’t, or conflicts between sales and marketing staffs. But with big data becoming an essential part of the marketing discipline, there’s more opportunity for marketing to impact a company’s future than we’ve seen since the dawn on TV advertising.

Listen to our 14 min. podcast here:

FIR B2B PODCAST #97: NOTABLE HITS AND MISSES IN GDPR PITCHES

In my role as a journalist, I’ve been deluged with hundreds of pitches for GDPR-related stories, which went into effect last week. It didn’t help matters that on the first day the UK commissioner’s website was down for a couple of hours, an Austrian privacy advocate hit Facebook and Google with billions of euros in lawsuits and the privacy browser plug in Ghostery sent out emails about its change in policy, but inadvertently cc’d 500 user names in each batch of email.

In this episode of FIR B2B podcast (19 min.), I discuss the impact of GDPR with my partner Paul Gillin, who has seen his fair share of pitches as well. We discuss some of the best and worst PR pitches we received in the months running up to the launch of the General Data Privacy Regulation, and why a handful stood out.

FIR B2B Podcast #96: Lessons from the demise of Klout

Klout is dead. The news wasn’t a surprise, and the announcement from its current owners at Lithium didn’t leave anyone tearing up. The idea of boiling influence down to a single number always struck us as overly simplistic. And the tools to measure influence are so much more sophisticated now than in Klout’s heyday.

But we should pause and understand why Klout fell into disuse and what marketers can learn about measuring the effectiveness of their social media campaigns. It’s also a good time to look at what other tools are available that are useful, such as LinkedIn Social Selling Index, (shown here) which gives your account various scores and then breaks them down into four components that have a little more meaning. You can see how you rank within your industry and within your LinkedIn network. There’s also Twitter Analytics, which tracks changes in your Twitter engagement through five different elements: tweets, tweet impressions, profile visits, mentions, and followers. Again, one number doesn’t really describe the range of influence that a social network provides, and you might want to focus on one or two elements as you measure your own reach.

I reviewed social media marketing tools many years ago and certainly that universe has seen some evolution, but SproutSocial, SimplyMeasured, Looker and Adobe’s Marketing Cloud are all still available and very reasonable measurement tools as you construct your campaigns. And as general purpose business intelligence tools such as Microsoft’s PowerBI and Domo become easier to use, they can be used for this purpose.

We also touch upon another looming deadline this week, with the GDPR regulations coming into full force. My podcasting partner Paul Gillin has written a piece about executives are turning more positive on its potential and also using the compliance deadline to effect some positive changes in their organizations’ privacy and data protection policies.

You can listen to our latest podcast (15 min.)here.

FIR B2B #94 podcast: Panera Dread

Panera Bread’s reaction to a breach of its customer records is a classic example of what not to do on so many levels that it’s hard to know where to start. Officials lied to reporters about the nature and extent of the breach, treated the security experts that knew what actually happened with disdain, took months to recognize the existence of the breach only after others revealed it to the public, told people that the leak was fixed when it wasn’t and glossed over the real issue: a major IT flaw in its application program interface specs that caused the breach to begin with (as well as another this week at P.F. Chang’s). It didn’t help matters that the chief information security officer at Panera came there from a similar job at Equifax in 2013.

The reaction from Ragan is a good summary of what happened and how the situation was mis-handled, and if you want more specifics from the security researcher that first found out about the flaw last August, can read this post on Medium. That latter link reproduces the email messages that showed how the company ignored the researcher’s notification. Firms need to hold themselves to better accountability, have breach plans in place, and make it easier for security researchers to submit vulnerability disclosures in a non-threatening and simple way.

My 14 min. podcast with Paul Gillin can be played here.

FIR B2B podcast #93: Is privacy finally a thing for B2B marketers?

With the #DeleteFacebook meme taking hold, this could be a turning point for privacy, or certainly is a major moment of reflection about what the role of marketing is in this debate. Marketers have certainly been dazzled by the potential of big data for targeting and personalization. Maybe they need to exercise more caution in the future, or at least respect the need for better privacy controls.

With my partner Paul Gillin, I discuss a few thoughts about the changing nature of privacy and what the revelations of the past week mean for marketers.

Reactions to the Facebook disclosures have been negative. The Internet Society has posted an op/ed saying that “Mark Zuckerberg’s apology is a first step, but it’s not enough.” Certainly, many people and businesses (SpaceX and Tesla are two corporate examples) are deleting their Facebook pages, but do they really understand that this data persists for quite some time? The EFF has this handy guide for individual privacy, and Wired has posted a more comprehensive series of suggestions here. We suspect that some corporate users will also get smarter about how their data is consumed by social platforms of the future.  Hopefully, some solid regulation will come of this movement, and a better appreciation of our customers’ privacy too.

On a related note, in perhaps the worst timed news yet, Slack has changed their privacy policy. Now business owners can download entire workspaces, where these conversations are recorded for posterity. We knew that our expectations around workplace privacy were low, but our IM chats too?

There’s also a new academic study on web tracking tools that shows that the threat of misbehaving third-party applications trampling on private data is huge. Thousands of these tracking tools are used by online advertisers, and many are good at evading ad blockers.

The notion of privacy by design has been around for more than a decade; perhaps marketers should take a moment to review some of its precepts.

Listen to our 12 minute podcast here.

Adrian Lamo, RIP

I first met Adrian Lamo back in 2002. I was teaching a high school networking class and I thought it would be cool to have the kids experience a “real” hacker, since so many of them aspired to learn how to get into the computerized grading system that the school ran. It wasn’t a very exciting teachable moment, as I recall. But Lamo made a big impact on me, as he couch-surfed in my New York suburban apartment.

Sadly, I learned that last week he died at age 37 in Wichita, KS. The cause of death hasn’t yet been determined, and he had been living in the area for the past year, according to reports. Lamo moves around alot, thanks to a rather interesting personality that could best be described as on the autism spectrum.  When I met him, he had the symptoms of obsessive-compulsive disorder and was later diagnosed with Aspberger’s. One of his quirks was that it would take him a while to leave my apartment every morning: he had a sequence of steps to follow in a very specific order before he could walk out the door.

Lamo was a study in contradictions: both very bright and very socially awkward, a Sheldon Cooper before his time. He had a high sense of morality. At the time Lamo stayed with me, he had been arrested for breaking into several different computer systems, including that of the freelancer database of the New York Times. His method was to find an open Web proxy server and use that to gain entry inside a corporate network. (It is still a common entry point method, although many companies have finally figured out how to protect themselves.) He never profited financially from these attacks, instead he would often leave hints on how a company could close these proxies and improve their security. He was sentenced to house arrest for the Times attack.

At the time we met, he was called the “homeless hacker” – not because he was living on the streets, but because he was young and had no fixed address, and would go from couch to couch as the mood took him. I offered him a place to stay and a chance to get to know him better, thinking how cool could that be? Little did I know.

When I told my then-teenage daughter about his impending visit, she was rather incredulous (you have someone wanted by the police staying with us) but ultimately she was won over by his geek cred – she had a problem with her cell phone that she recalls him fixing in a matter of seconds.

Well, Lamo went on get a degree in journalism, ironically enough. He was very connected to the tech trade press, and Brian Krebs recalls his various interactions with him in this post.

Lamo is remembered in various tributes in the past few days with his role in the Wikileaks/Cablegate case of 2010, when he divulged the name of Private Manning to the feds as the leaker. Both then and now, his decision was vilified in the hacking community, with numerous online threats.

I had a chance to speak to Lamo back in 2011 and recorded the interview for ReadWrite, where I was working at the time. It covers a lot of ground:

He has some very wise comments about the importance of government secrecy, and the freedoms that it enables for us all. Lamo saw the Manning case from the other side, as a case that would be eventually remembered supporting our freedoms. It was a real issue for him, because as a hacker he could certainly understand what Manning was trying to do, but as someone who also understood the role of our military he couldn’t in good conscience allow her to leak all that data. When Manning contacted Lamo he had a crisis of conscience and made his decision. He struggled over harming Manning, whom he considered a friend, or harming countless others who would be placed at risk because of Manning’s leaks. He wishes Manning had come to him before making the documents public.

This is certainly an interesting position for a hacker to take, to be sure. He was vilified in the hacker community because of it, but I think he made the right decision. “Who would have thought that when we first met ten years ago that I would have been involved in the single biggest intelligence leak in history,” he told me. How true.

He continued to work as a security consultant, helping corporations understand better security practices as well as going out on the speaking circuit. Ironically, his preferred method of communications more recently was FedEx! “I’m a little bit of a Luddite these days,” he said.

Lamo left this planet far too soon. He was a very smart guy and had a very solid moral compass, and those two traits guided his actions all his short life. I am sad that he is no longer with us, and hope that his life can be noted and celebrated for his accomplishments, verve and significance.

FIR B2B podcast #92: TechTarget CMO John Steinert on the science of ‘intent marketing’

John Steinert joined TechTarget as CMO two years ago after a decades-long career in B2B technology at companies that included Pitney Bowes and SAP. So why join a tech publisher? Steinert actually doesn’t see TechTarget as a publisher, and in this recent piece he explained why he was so excited about the opportunity: product, purpose, people and potential. In this interview we discuss the differences between publishing and content marketing, how intent marketing can help provide insights into impending technology purchase decisions and how marketers can make their content more effective and targeted. 

TechTarget’s not-so-secret weapon is its lead generation and tracking mechanisms, which permit the company to see exactly what kinds of content is crucial for their visitors. Steinert describes what data is collected — with visitors’ permissions of course — and how it can be used by their advertisers and sponsors. He also distinguishes between visitors who are just looking to snack on information versus binge consumers, who are likely closer to purchase.

This all makes a difference in what kind of content is created and how keywords are chosen to bring in the right visitors. “You have to have strong SEO, people have to find your stuff and it has to be cross-linked and judged popular and valuable,” he says 

TechTarget’s distinction has always been its portfolio of microsites focused on technologies products or categories — such as SearchWindowsServer.com. But you’d be hard-pressed to find the names of those sites on the company’s home page today. That’s deliberate. Far from being a publisher, TechTarget is today a data company.

Incidentally, both Paul and myself have had a long connection with TechTarget: Paul was the company’s sixth employee and I have been a regular freelancer for numerous websites of theirs.

There is a lot of wisdom in what Steinert says, and he is worth a careful listen to our 25 min. podcast here.