Show Image
   21 episodes



Security Stories

Cisco Secure

21 episodes

Nov 23, 2020

20: Creating safe spaces, and the troubling nature of attribution in threat research, with Chloé Messdaghi and Warren Mercer 

In today's episode we're delighted to welcome Chloé Messdaghi, an infosec advocate and activist who is working to create a safe space for underrepresented groups within the industry.

Chloé is the CEO and founder of W
e are Hackerz, as well as the cofounder of Hacking is not a crime, Women of Security and The Hacker Book Club, and she is also VP of Strategy at Point3 Security.

We chat about the growing issue of burnout and how people can spot the signs within themselves and others.  Chloé also reveals how she comes up with her ideas, and how she is seeking to address certain issues in the cybersecurity industry such as women and underrepresented groups being trolled online. Plus, we discuss the fight for the truth in a growing age of misinformation.

Our second guest is Warren Mercer, a threat researcher from Cisco Talos who helped to discover the Olympic Destroyer attack in 2018.  Warren is in the studio with Ben and Hazel to discuss the research he’s being doing on the evolution of Remote Access Trojans, and one of the newest players, Poetrat

We also discuss his starring role in the new multi part documentary by Tomorrow Unlocked, called 'Who hacked the 2018 Winter games’. That then brings us onto the topic of why  attribution is so difficult in the threat landscape, and what some of the consequences are of misattribution.

Nov 9, 2020

19: Finding your own voice, with Javvad Malik 

Our guest today is one of the security industry's most prolific video bloggers, Javvad Malik. Javvad has a signature fresh and light hearted take on security, and during this interview he talks about how he found his own voice. He also has plenty of advice for our audience on how to put a great presentation together to keep your audience engaged.

In addition, Javvad's story on how he got into the security industry, and the people who helped him along the way, is well worth a listen to. Plus, we discuss the "Zombieland" rules for Security, and find out what kind of movie Javvad would make if he was put in charge of such a thing.

Also in this episode, we bid a fond farewell to Noureen who is moving on to an incredibly exciting new adventure. Before she goes however, she has some wonderful words of inspiration and wisdom for our listeners.

And finally Ben has some brand new threat research for us. He's here to tell us all about Remote Desktop Protocols. We examine the ways in which RDP has been a target of bad actors over the years, covering unauthorized logins, man-in-the-middle attacks, and vulnerabilities, including the ‘wormable’ BlueKeep exploit. You can learn more about this research at

Episode time stamps:

0.00 - 14.16: Intro and saying goodbye to Noureen
14.17 - 54.50: Interview with Javvad Malik
54.51 - 67.54: Threat of the month (RDP attacks) with Ben
67.55 - 69.09: Closing words

Oct 18, 2020

17: Distorting the truth: The roots of online political disinformation campaigns, with Theresa Payton and Nick Biasini 

On today's episode we’re heading into the murky waters of online manipulation campaigns, and particularly how they’re used to try and influence political elections. 

To do that, we welcome back Theresa Payton, the first female CIO of the White House and author of
'Manipulated: Inside the Cyberwar to Hijack Elections and Distort the Truth'. We also welcome for the first time, Nick Biasini. Nick is a threat researcher within Cisco Talos and recently published a paper called ‘The Building Blocks of political disinformation campaigns’, which is part of Talos’ hands on research into election security.   

We chat about some of the things that shocked Theresa when she was doing her research into manipulation tactics, as well as the amplification methods that are being used to spread certain lies online. Plus, we talk about what can be done to curb these campaigns with only a few weeks to go until the United States general election.

This is a really fascinating discussion, and whilst it highlighted the huge challenges that we’re facing at the moment, Nick and Theresa shared a lot of great information on how we can overcome them.

Also in this episode, Ben Nahorney shares his latest research on current threat trends. This time we rank the Indicators of Compromise that organizations have encountered grouped by particular topics, including ransomware, credential stealing, and looking at the top operating system IoCs.

Link to Manipulated: Inside the Cyberwar to Hijack Elections and Distort the Truth'
Link to ‘The Building Blocks of political disinformation campaigns’

Oct 11, 2020

16: Openness and support: Discussions on why diverse representation matters in cybersecurity 

On today's episode, Hazel and Noureen are joined by Leticia Gammill, Cisco’s Channel leader for Canada and Latin America, and Matt Watchinski, Vice President of Cisco Talos.  

Together, we share our first hand experiences and stories on the impact of diversity in cybersecurity.  There are some brilliant insights here about where companies can find diverse talent, beyond the usual recruitment channels. 

We also discuss how organizations can build a culture of mentoring and support, so that members of diverse teams can feel appropriately valued, and retainment levels are strong. 

Also in this episode, Hazel chats to Cisco’s new CISO, Mike Hanley. Mike became our CISO in June, after 5 years in Duo where he was part of Duo Labs and then became Vice President of Security, and built and nurtured the team around him. 

From the importance of hiring a multitalented diverse team, to building a culture of appreciation, openness and fun, Mike’s interview is a fascinating listen for anyone leading a team today. 

We hope you enjoy this episode, and are inspired by both of these discussions as much as we were when we recorded them.

Episode timestamps:

0.00 Intro
02:27 Discussion on diversity in cybersecurity
46:49 Mike Hanley interview
1h 26: Closing remarks

For more on this subject, do check out our new eBook, "Diversity in cybersecurity: A mosaic of career possibilities".  It contains over 20 interviews with cybersecurity professionals from around the world.

We asked them how they all got their starts in the industry, and what they would tell their younger selves if given the chance.  You can read that ebook by visiting

Oct 4, 2020

15: Taking the unconventional cybersecurity career path, with Curtis Simpson 

In the first of four special episodes being released during the month of October, today's episode is all about cybersecurity careers.

Hazel, Ben and Noureen are joined by guests Mitch Neff and Corien Vermaak, for a discussion on how we all got our starts in the cybersecurity industry. As it turns out, none of us took a conventional path! We also talk about the people and the mentors that helped us along the way, including some practical advice for anyone who wants to be a mentor, or gain a mentor.

We passionately tackle the topic of job descriptions and why they might be contributing to the so called "cybersecurity skills gap". We also talk about what hiring managers can do to make sure they're not putting the right people off with their words.

Before that, Hazel meets Curtis Simpson, Chief Information Security Officer at Armis to discover his story. A self taught cybersecurity geek, Curtis spent 20 years at Sysco, building a decentralized network.

He talks about how he turned around perceptions on cybersecurity being a cost centre, and focussed on how cybersecurity could contribute to business outcomes. He also touches on just how difficult a decision it was to leave after 20 years, but how he knew it was the right thing.

We also talk about his organisation's reaction to COVID-19, and Curtis' take on the current threat landscape, particularly around securing IoT devices.

We hope this episode proves that that there is no singular footpath into cybersecurity.  And that’s no bad thing.

Time stamps:

0.00 Intro
3.46 Interview with Curtis Simpson
47.26 Discussion on careers in cybersecurity
1.42.00 Close

Here are some more resources as mentioned in our careers discussion:

Noureen's cybersecurity mentoring hub:
Noureen's mentor and mentee group on LinkedIn:
Cisco NetAcademy courses:
Blue Team Village Discord of which Talos are a sponsor:

Also check out our just published eBook: Diversity in Cybersecurity: A Mosaic of Career Possibilities

Sep 21, 2020

14: Not fearing failure, and challenging the status quo, with Chris Leach 

Today we chat to Chris Leach, senior CISO Advisor at Cisco. From his background as an accountant (which he hated!) to venturing into cybersecurity ("I had to learn to speak in bits and bytes, after only speaking in 1s and 0s"), he has a fascinating story to share. 

Chris also has some brilliant insights into how to be a great leader and role model for your team, and he has some really poignant thoughts on resiliency, bouncing back, and dealing with the fear of failure.

Also in today's episode, Ben shares the highlights of his just-published research on threat landscape trends. The idea behind this work is to shed light on areas where you can quickly have an impact defending your assets, especially if you're dealing with limited security resources. You can read more about this in Ben's
blog post.

And finally our 'On this Day' feature takes us back to the movies! In honor of the 25th anniversary of the film Hackers, the team sits down to talk about what that movie got right, and perhaps, not so right, with some surprising reveals.  

We also discuss what our own movies on cybersecurity would look like, if we were each in charge of screenwriting. Personally, we hope Noureen's idea does genuinely get greenlit!

In October, we're doubling our production schedule to release episodes on topics that mean a lot to us, including careers and diversity in cybersecurity, and how to protect your loved ones from disinformation campaigns (or "fake news) online. It would be brilliant if you could subscribe to your podcast feed of choice so that you don't miss any of these exciting episodes.

Sep 7, 2020

13: Prime directives: Serving the public trust, protecting the innocent, and upholding security laws, with Tanya Forsheit 

We almost called this episode "Robocop 4: The future of security law enforcement", but we actually hope that movie happens so we didn't want to jinx it...

But security law is our prime directive today, as on this episode we have an interview with Tanya Forsheit, partner at Frankfurt Kurnit Klein & Selz and co-chair of the firm's privacy & data security group. Tanya is considered one of the world's leading data privacy and security counselors and litigators.

During our chat, we talk about why the United States needs a privacy law at the federal level, similar to what the European Union has done with GDPR. We also talk about what the future holds for data privacy in the next 12-24 months, within the context of COVID-19 and an increasing amount of IoT devices.

Tanya is also highly experienced in data breach incidents, and is often involved in data rescue operations for her clients. So she has some great views on response planning and business continuity.

Before that, Noureen brings us some fascinating stories from her recent mentor and mentee workshop sessions, including how people who were made redundant back in March at the start of lockdown have been able to find new jobs in the cybersecurity industry. We also have a chat about careers and job descriptions, and why perhaps more thought needs to go into some of those descriptions in order to attract more people who are passionate about the industry.

For our "Emerging Threats" section Ben has been doing some very in depth research into the ransomware variant "WastedLocker". He talks about the nuances of this attack and how the bad actors spread across the network to further compromise additional systems until all the key systems are under their control.  You can read more in his blog

And finally for "On this Day" our time travel machine takes us back to 2003, and the story of the Blaster worm. For Ben, this was a trial by fire as he had just started work in a threat intelligence company and this was his first project. Hear him relive some not so fond memories!

:: / ::
1.0x 1.5x 2.0x