Crucial Tech

During @RSAC Conference in April I met with Matthew Gracey-McMinn, VP of Threat Services for Netacea and we talked about the damage malicious bots can do. His company is one of a handful of companies dedicated to protecting users against that threat, in particular media companies. It was a short conversation and I decided it was worth going into a bit more depth.

Last week, Dr. Zero Trust, AKA Dr. Chase Cunningham, posted in Linked in that he was fed up with people who say they don’t understand Zero Trust. To a certain extent, I feel his frustration.

Journalists understand the concept. We have a decades-old saying, “If your mother says she loves you, check it out.” It doesn’t get more zero trust than that.

The problem is that while it’s easy to understand as a concept, it isn’t easy to build a zero trust infrastructure, especially with the misleading gobbledygook most cybersecurity companies put out. Cunningham says there are hundred of books and articles on the subject. He’s right, of course. The question is, which one do you choose? 


At the RSAC Conference, I sat down and briefly talked with Dale Hoak, CISO for RegScale, about how easy it is to understand Zero Trust but how complex it can be to pull it off. RegScale does government regulation compliance (GRC) and has only been around since 2021, but I found several competitors who promote themselves by saying “when you’re tired of RegScale, come see us.” I find that a ringing endorsement of the company.

So I called Dale up and said I wanted a longer talk about the issue of Zero Trust and where GRC fits in. We also spent some time talking about how the US federal government seems to be stepping away from cybersecurity regulations. I’ll be doing a larger story about that later, but this conversation is a good start.

Physical authentication keys are a common trope in movies, TV and spy thrillers and they have been around for almost 20 years. But they are still hard to find in real life. We talked with Alex Summerer, head of authentication for Swissbit, which is a relatively new player in the field, headquartered in ...of course, Switzerland. Frankly, after talking with him I'm wondering why I haven't bought one of these things.

Still digging through dozens of hours of recordings and pages of notes from #RSAC_Conference last week. But while looking into the issue of bots, both good and bad, discovered a fairly recent story about how scammers use bots to steal financial ait. And as I always say, if I don't know about something, I know someone who does. So I called up an old friend, Craig Mosher, who teaches history and political science about what he has experienced with fake students and how to deal with them.

This was another exhausting #RSAC in San Francisco but I think I'm finally getting a handle on it. There will be more to come, but Bruce Schneier gave a keynote on Tuesday that I think bodes well for journalism.

And we had a visit with our friend at Safety National Insurance, Spencer Timmel, about just how far insurance can cover cybersecurity wweaknesses.

This is a short episode previewing what I'll be doing at RSAC 2025 next week, kudos to the California Franchise Tax Board, and a how-to on working with the press.

The "Signalgate" scandal has raised the issue of encryption to a broader audience in the past week.  On the plus side, many sources say that 95% of digital traffic is encrypted now, compared to 43% in 2014, but most people have no idea that their personal data is being encrypted. It’s one of those invisible technologies that touch many people.

But there is a basic fact, that a lot of stuff that should be secured, isn’t because users don’t know they have to turn it on  For example, WhatsApp, the messenger platform from Meta, advertises that they have end to end encryption, but they don’t tell you that you have to turn it on to get that benefit. 

So that brings us to today.  What is encryption? Why do we need it and where does it come into play.  We talk with Luigi Caramico, CTO and founder of DataKrypto, a company dedicated to encryption. And not just encryption but fully homomorphic encryption, an important step forward in protecting our data

I get a lot of "studies" about the state of cybersecurity and most of them are poorly done. In Episode 10.8 I talked about one I like, from Huntress and the week it came out I got pitched another report from iProov that was, well, less than well done. And as much as I tried to help them focus on reality, the more they pushed back.

Again, this is not a knock on what the company does, which is to ensure the veracity of biometric identity, but it is a good example of how cybersecurity companies spend too little and on the wrong efforts to get their story out.

I am very far behind in writing stories and making podcasts. The events since January 20 have made it difficult to keep up. But today, while walking downtown I came across a brand-new independent book store That had a copy of a book dedicated to Martin Luther King Jr.'s "Dream" speech.

I attended that event, with my mother, when I was 11. It was a foundational moment for me. It is when I became "woke." When I saw that book, I knew I had to buy it for my grandchildren, because being two generations separated from that moment is too far. I needed to bring it forward for them, so I bought the book for them and intend to read it to them and help them understand how important the dream is for them as well, especially today.

This isn't a political issue for me. It is how I want to model my life. It does afect my politics, but it also affects my view of family, friends, neighbors, theology, and the world. If you choose to listen to me read this speech, I thank you for taking the time. My thanks extends even to those who are offended by it, as long as they listen to it. It is important to hear, even 60+ years after the fact. Only by repeating it can we learn from it.

James Bore is a cybersecurity consultant, speaker and publisher based in the UK. He has a refined sense of cynicism that clicks with my own, so we've been chatting back and forth for several months on various subjects and decided it's probably time to record some of our interaction.

Today, we are looking at the preferred marketing practice (shiny objects) of sewing fear, uncertainty and doubt to get people to buy their products. It drives us both nuts. The issue is not limited to cybersecurity, but it is prevalent in the industry. I'm guessing this conversation will resonate with many of you. Our hope is that our marketing listeners will rethink some strategies,

We open a new year and a new season with our friend, Ian Thornton-Trump, chief information security officer at the MSSP Inversion6 and in 30 minutes we take on some pretty meaty subjects.

First we discuss how China strategically infiltrated technology systems in the US and other countries as a geopolitical message rather than attacks. He discusses the challenges of securing complex, interconnected systems and the need for proactive defense.

Next we review the rise of corporate power and influence and how the increasing wealth and influence of individuals like Elon Musk is disrupting the traditional balance of power in democracies. The ethical concerns around wealthy individuals wielding disproportionate political influence could result in something the oligarchs are not expecting.

Finally, we review potential trade wars and the possibility of Canada and Mexico joining the BRICS alliance.

2025 is going to be bumpy but very interesting.

The available guests for this last podcast of the year dried up pretty quickly so I thought I would give some closing thoughts on a big issue facing the world: Trust and the lack of it.

Also, our last threat reports courtesy of Fletch.ai

I bet you never heard of FHE. Me neither. Then I got a pitch about it. Tried to ignore it because I had never herd of it, but they were insistent. Turns out to be interesting.

Fully homomorphic encryption, or FHE, has been talked about for about five years but not it has its very own industry association and NIST is starting to take it very seriously. It doesn't eliminate quantum encryption standards, but it might be a better defense against nation state attempts to break the strongest modern encryption, although I still think that's more a fever dream than a potential reality.

One of the members of the new association with the unfortunate name of FHETCH, Niobium put me in front of the chief product officer, Jorge Myszne, to give me the lowdown on this tech.

Firts, apologies for the sound quality. Tried out a new microphone and I definitely do not like it. Going back to the tried and true. But it stands as an example of what we are talking about today. When people from one discipline start talking about moving into another discipline where they lack expertise, things go haywire. Such is the case with the digital world and energy production.

The big news this week is Microsoft plans to open up Three Mile Island Nuclear power plant to power their planned AI datacenter. Joe Basques and I have a frank discussion about how the AI/Social Media/Internet industry just lacks the knowledge of how to do this right and with the current path, chaos is bound to reign,

In the first part of this series we provided a potential solution to the out-of-control growth of data theft, for individuals that could be most at risk. Today we talk to John Meyer, senior director at Cornerstone Advisors, to help us understand just how bad the situation is.

For example, ner the end, John states quite flatly that everyone whould just assume their social security number is being sold en masse by criminals. And there is nothing we can do about it.

Think about that.

The problem with election security is not a failure of the technology to keep the vote honest, it's the lack of technology available to individual voters to reduce fraud. We talked with YouMail CEO Alex Quilici about how some SPAM-mail technology can help, but also what kind of dangers there are that voters should be aware of.

I went to a high school graduation for the first time in decades. What I saw and heard filled me with compassion and concern for the next generation.