Zero-Trust is Meaningless if Your Cryptography is Flakey - Vincent Berk - ESW #349

Feb 9, 2024

Vincent Berk, cybersecurity expert, discusses the importance of cryptography and zero trust. They explore the risks of outdated algorithms and the need for actively managing cryptographic systems. The chapter emphasizes the challenges of separating cryptography from other data and the growing importance of quantum-safe algorithms. The speakers also touch on the risks of cybersecurity companies going public and the acquisition of Protect AI and layer AI. They discuss a decentralized alternative to Twitter and the voluntary cybersecurity performance goals for hospitals.

Ask episode

Chapters

Transcript

Episode notes

Introduction

00:00 • 3min

Discussion on Fat Thursday and Dutch Traditions

03:04 • 2min

Third Party Risk, Importance of Cryptography, and Introduction of Dr. Vincent Burke

05:00 • 1min

The Importance of Cryptography in Cybersecurity

06:30 • 21min

Managing and Controlling Cryptography Libraries

27:53 • 18min

Discussion on Quantum Exchange and Event Announcements

45:28 • 3min

Pizza Toppings: Preferences and Opinions

48:07 • 4min

The Potential Risks of Cybersecurity Companies Going Public

52:05 • 14min

Acquisitions of Protect AI and layer AI

01:06:17 • 14min

Blue Sky: Twitter's Decentralized Alternative

01:20:13 • 15min

Voluntary Cybersecurity Performance Goals for Hospitals and the Potential for Future Regulation

01:35:32 • 3min

Legacy systems are riddled with outdated and unreliable cryptographic standards. So much so that recent proprietary research found 61 percent of the traffic was unencrypted, and up to 80% of encrypted network traffic has some defeatable flaw in its encryption

No longer can enterprises take their cryptography for granted, rarely evaluated or checked.

Knowing when, where and what type of cryptography is used throughout the enterprise and by which applications is critical to your overall security policy, zero-trust approach, and risk management strategy. After all, zero-trust is meaningless if your cryptography isn't working.

Segment Resources: https://www.businesswire.com/news/home/20231030166159/en/Proprietary-Research-from-Quantum-Xchange-Shows-the-Dreadful-State-of-Enterprise-Cryptography

https://www.forbes.com/sites/forbestechcouncil/people/vincentberk/?sh=3d88055852c1

This segment is sponsored by Quantum Xchange. Visit https://securityweekly.com/quantumxchange to learn more about them!

This week, we discussed how a quick (minutes) and cheap ($15 a pop) fake ID service creates VERY convincing IDs that are possibly good enough to fool ID verification services, HR, and a load of other scenarios where it's common to share images of an ID. Kudos to 404Media's work there.

In the security market, we discuss who might be the first cybersecurity unicorn to go public in 2024, Oasis Security and Tenchi's funding rounds, Protect AI's acquisition of Laiyer AI and their FOSS project, LLM Guard. We discussed the seemingly inevitable M&A activity as unfunded security startups NEED to find a sale. Ross Haleliuk had an interesting LinkedIn post that goes deeper on this topic. Finally, we discussed Tyler's observation that Palo Alto Networks did the seemingly impossible - increased their valuation from $19B to over $100B in 5 years, despite having to weather a pandemic and market downturn along the way! Ryan pointed out that PANW joined the S&P 500 somewhere along the way - a watershed moment for them.

We discussed Bluesky and how it's likely too little too late when it comes to building back the community we lost when much of the InfoSec community left Twitter.

We also discussed a cybersecurity training scammer, Daniel Miessler's new Fabric tool, AnyDesk getting hacked, The Real Shim Shady vuln, new (voluntary) cybersecurity goals for healthcare, and the lack of toothbrush-enabled DDoS attacks!

Full show notes here: https://www.scmagazine.com/podcast-episode/3061-enterprise-security-weekly-349

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-349