8th Layer Insights

In this episode, Perry Carpenter interviews cybersecurity guru Bruce Schneier. Perry and Bruce explore how cybersecurity is about so much more than technology — It’s about people, so we benefit by taking a multidisciplinary approach.

In preparing for this interview, Perry solicited his LinkedIn network to see what questions people had for Bruce. This is a wide ranging conversation covering everything from Bruce’s thoughts on cybersecurity’s “first principles” to the impact that the pandemic had on society to need for regulation to help raise the overall standards for security and privacy.

Guest: Bruce Schneier (https://www.schneier.com/blog/about/) (https://twitter.com/schneierblog)

• Bruce's personal website 'about me' page: https://www.schneier.com/blog/about/
• Wikipedia article about Bruce Schneier: https://en.wikipedia.org/wiki/Bruce_Schneier
• Another background article about Bruce: https://www.cybersecurityeducationguides.org/bruce-schneier-legendary-cryptographer/
• More Background on Bruce: http://academickids.com/encyclopedia/index.php/Bruce_Schneier
• Bruce's Solitaire encryption algorithm: https://www.schneier.com/academic/solitaire/
• More info on the Solitaire algorithm: https://www.schneier.com/blog/archives/2019/10/more_cryptanaly.html
• Proximity Blindness: https://dannyozment.com/cant-see-the-forest-for-the-trees-the-dangers-of-proximity-blindness-2/
• The story of the Blind Men and an Elephant: https://en.wikipedia.org/wiki/Blind_men_and_an_elephant
• Cryptography After the Aliens Land: https://www.schneier.com/essays/archives/2018/09/cryptography_after_t.html
• Secrets and Lies book preface with "If you think" quote: https://www.schneier.com/books/secrets-and-lies-pref/
• "if you think cryptography" quote: https://news.ycombinator.com/item?id=19589899

Recommended Books (Amazon affiliate links):

• Applied Cryptography: Protocols, Algorithms and Source Code in C, by Bruce Schneier
• Beyond Fear: Thinking Sensibly About Security in an Uncertain World, by Bruce Schneier
• Click Here to Kill Everybody: Security and Survival in a Hyper-connected World, by Bruce Schneier
• Cryptography Apocalypse: Preparing for the Day When Quantum Computing Breaks Today's Crypto, by Roger Grimes
• Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World, by Bruce Schneier
• Liars and Outliers: Enabling the Trust that Society Needs to Thrive, by Bruce Schneier
• Secrets and Lies: Digital Security in a Networked World, by Bruce Schneier
• Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter

Music and Sound Effects by Blue Dot Sessions & Storyblocks.

Artwork by Chris Machowski.

Have you ever taken time to view the world through the eyes of an attacker? Doing so is an interesting and useful exercise. Understanding the mind of an attacker is fundamental to securing your organization or aspects of your personal life. After all, if you aren't doing the job of viewing things from an attacker's perspective, that means that only the attackers are. The idea is to understand the mindset, motivations, and capabilities of a possible threat actor so that you aren’t simply oblivious to your vulnerabilities.

This episode is a deep dive into attacker mindsets, we’ll hear from four experts who really know what it is to view the world through the eyes of an attacker. Featuring Chris Kirsch (DEF CON Social Engineering CTF Black Badge winner and co-founder of Rumble, Inc.), David Kennedy (Founder of Binary Defense and TrustedSec), Maxie Reynolds (Author of The Art of Attack: Attacker Mindset for Security Professionals, and Technical Team Leader, Social-Engineer, LLC), and Ted Harrington (Author of Hackable: How to Do Application Security Right, and Executive Partner at Independent Security Evaluators).

Guests:

• Maxie Reynolds (https://www.linkedin.com/in/maxiereynolds/)
• David Kennedy (https://www.linkedin.com/in/davidkennedy4/)
• Chris Kirsch (https://www.linkedin.com/in/ckirsch/)
• Ted Harrington (https://www.linkedin.com/in/securityted/)

Books and References:

• Bruce Schneier blog about the Security Mindset: https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html
• Origin of "Devil's Advocate": https://allthatsinteresting.com/devils-advocate-origin
• Lockheed Martin Cyber Kill-Chain: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
• What is Threat Modeling: https://securityintelligence.com/posts/what-is-threat-modeling-and-how-does-it-impact-application-security/
• 12 Methods of threat Modeling: https://insights.sei.cmu.edu/blog/threat-modeling-12-available-methods/
• The Art of Attack: Attacker Mindset for Security Professionals by Maxie Reynolds
• Hackable: How to Do Application Security Right by Ted Harrington
• The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick
• Threat Modeling: Designing for Security by Adam Shostack
• Threat Modeling: A Practical Guide for Development Teams by Izar Tarandach and Matthew J. Coles
• Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter

Music and Sound Effects by Blue Dot Sessions & Storyblocks.

Artwork by Chris Machowski.

This is the first of a two part series covering Cybersecurity’s ABCs: Security Awareness, Behavior, and Culture. We touched on facets of Awareness in Episode 1 and Behavior in Episode 3. These two episodes cover the cybersecurity ABCs in a very pragmatic way, with this episode covering Awareness and Behavior and Episode 10 providing a deep dive into Culture.

Guests for this episode include, Dr. Jessica Barker (co-CEO and Co-Founder, Socio-Technical Lead at Cygenta; author of Confident Cyber Security and co-author of Cybersecurity ABCs), Chrysa Freeman (Senior Program Manager for Security Awareness at Code42), Ian Murphy (Founder, CyberOff), and Lauren Zink (Senior Security Awareness Specialist at Boeing; author of LinkedIn Learning courses: Creating a Security Awareness Program and Building a Security Awareness Program: Phishing Simulations).

Guests:

• Dr. Jessica Barker
• Chrysa Freeman
• Ian Murphy
• Lauren Zink

References, Resources & Books:

• 5 Things You May Not Know About Security Awareness Training, by Perry Carpenter
• Confident Cyber Security: How to Get Started in Cyber Security and Futureproof Your Career, by Jessica Barker
• Cybersecurity ABCs: Delivering awareness, behaviours and culture change, by Jessica Barker, Adrian Davis, and Bruce Hallas
• The Dilemma: Should you phish test during the COVID-19 pandemic?, by Perry Carpenter
• Down the Rabbit Hole: Why People Question the Value of Security Awareness, by Perry Carpenter
• Do You Care More about What Your People Know, or What they Do? Coming to grips with the knowledge-intention-behavior gap, by Perry Carpenter
• The Fundamental Importance of Choice and Variety in Security Awareness Program Content, by Perry Carpenter
• G.I. Joe Public Service Announcements compilation
• Perry Carpenter's (ISC)2 Info Security Professional Journal 4 episode series on Security Awareness (Episode 1, Episode 2, Episode 3, Episode 4)
• People-Centric Security: Transforming Your Enterprise Security Culture, by Lance Hayden
• Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter
• Video: Simulated Phishing Campaign Notification for Your Users
• Video: Coronavirus Phishing Post-Click User Education
• Well Aware: Master the Nine Cybersecurity Habits to Protect Your Future, by Ge...

This is an episode about the battle for truth. As disinformation, misinformation, malinformation, and conspiracy theories seem to be hitting epidemic levels, how can we help each other determine what is real and what is fake? How can we help people who are falling down conspiracy rabbit holes? And what roles do technology companies, governments, and ordinary citizens play?

Perry Carpenter speaks with acclaimed cybersecurity expert, Bruce Schneier, disinformation experts, Samantha North and Allie Wong, and conspiracy theory researcher, Mick West. In this episode, we also hear from Peter Leyden from Reinvent and Eli Periser, author of The Filter Bubble.

Learn more about our guests here:

• Bruce Schneier - Internationally renowned security technologist, author, and speaker. You can find Bruce's website here.
• Allie Wong - VP of Mis/dis/mal-information, Response and Resiliency, Limbik; Consultant, United Nations Institute for Disarmament Research. (LinkedIn)
• Samantha North - Disinformation researcher and consultant. (LinkedIn) Co-Founder: North Cyber Research (website)
• Mick West - Skeptical investigator and retired video game programmer. Creator of the websites Contrail Science (website) and Metabunk (website). Author of Escaping the Rabbit Hole: How to Debunk Conspiracy Theories Using Facts, Logic, and Respect (link). Personal website (link).

Special thanks to Reinvent for allowing use of audio.

References:

• http://reinvent.net/events/event/how-we-can-pop-the-filter-bubble-with-eli-pariser/
• https://reboot-foundation.org/study-social-media-poor-judgment/
• https://reboot-foundation.org/is-there-a-fake-news-generation/

Recommended Books (Amazon affiliate links):

• Escaping the Rabbit Hole: How to Debunk Conspiracy Theories Using Facts, Logic, and Respect by Mick West.
• Click Here to Kill Everybody: Security and Survival in a Hyper-connected World by Bruce Schneier.
• The Filter Bubble: How the New Personalized Web Is Changing What We Read and How We Think by Eli Pariser.
• Thinking, Fast and Slow by Daniel Kahneman.
• Why Are We Yelling?: The Art of Productive Disagreement by Buster Benson.
• The Righteous Mind: Why Good People Are Divided by Politics and Religion by Jonathan Haidt.
• Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter.

Music and Sound Effects by Blue Dot Sessions & Storyblocks.

Artwork by Chris Machowski.

In this episode, Perry Carpenter sits down with renowned mentalist and skeptic, Banachek. Banachek (Steve Shaw) grew up with a fascination in magic and a frustration with psychic frauds. As a teenager, he contacted magician and skeptic, James “The Amazing” Randi and ended up working with Randi on a special initiative known as Project Alpha, which set out to expose a general lack of objectivity in parapsychology research. Banachek served as the director for the James Randi Educational Foundation’s “One Million Dollar Paranormal Challenge” for 15 years and is now the President of the James Randi Educational Foundation.

Perry and Banachek discuss Project Alpha, the ways of fake psychics and fraudulent faith healers, and issues associated with confirmation bias and framing effects. They also discuss Banachek’s new live mentalism show in Las Vegas, which incorporates theatrical mindreading and other mentalism effects along with a storyline that explores Banachek’s life, antics, and passion for critical thinking.

Guest:

• Banachek (Website) (twitter): Mentalist (Performing in Las Vegas add 'social' for 30% off tickets), Skeptic, President of the James Randi Educational Foundation
• This episode also featured a quick comment from: George Finney: (LinkedIn); Chief Security Officer at Southern Methodist University; Founder of Well Aware Security

Books and References:

• Banachek Wikipedia entry
• Project Alpha Wikipedia entry
• James Randi Wikipedia entry
• Article about Houdini's efforts to debunk fake mediums
• The Discoverie of Witchcraft Wikipedia entry
• The Psychology of the Ouija
• Barnum Effect Wikipedia entry
• James Randi & Project Alpha Video
• Project Alpha lookback -- James Randi and Michael Edwards
• Psychological Subtleties vol 1, by Banachek
• Behind the Scenes with the Mediums, by David Abbott
• The Discoverie of Witchcraft
• Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter

Music and Sound Effects by Blue Dot Sessions & Storyblocks.

Artwork by Chris Machowski.