In this episode, technology journalist Jane Wakefield joins cybersecurity veterans Graham Cluley and Carole Theriault to discuss a range of interesting topics. They dive into the potential privacy risks of minimizing video calls, the debate on paying for Facebook and Instagram, and the issue of fake endorsements promoting cryptocurrency scams. They also explore the cost of privacy and the value of personal data. The podcast covers discussions on online privacy rulings, identity attacks, diversity in tech conferences, and the challenges of securing user accounts in the cloud. The episode features an interview with Adam Bateman, founder and CEO of Push Security, who talks about shadow identities. It's an entertaining and informative conversation with a warning for adult themes and language.
Securing the identity attack surface in the cloud is crucial for maintaining a strong security posture.
Identities have become the new perimeter in the rise of cloud infrastructure, increasing the risk of compromised user accounts.
Facebook's new subscription option in Europe, allowing users to choose between personalized services with ads or an ad-free experience, is facing legal challenges due to the perceived disproportionality of the subscription cost.
Deep dives
Understanding the Identity Attack Surface
The concept of the identity attack surface refers to the user accounts that exist in the cloud, including those in SSO providers and various cloud applications. These accounts serve as potential entry points for attackers into an organization's cloud infrastructure. With the shift towards cloud-based infrastructure, securing the identity attack surface has become a crucial aspect of maintaining a strong security posture.
The Evolution of Attack Strategies
Over time, attackers have adapted their strategies based on the changing security landscape. Initially, perimeter-based testing was prevalent, but as organizations enhanced their perimeter defenses, attackers shifted their focus to targeting endpoints through methods like spear-phishing. Now, with the rise of cloud infrastructure, identities have become the new perimeter. Organizations must be aware of the increased risk associated with compromised user accounts in the cloud.
Challenges in Protecting the Cloud Identity Attack Surface
Protecting the identity attack surface in the cloud presents several challenges. One of these is the relative novelty of cloud-based attacks, leading to a lack of understanding and detection capabilities. Traditional on-premises security measures may not effectively monitor cloud-based attacks. Moreover, the decentralized nature of cloud infrastructure makes it difficult to enforce consistent security policies and detection measures. Organizations must adapt their security practices to effectively secure their cloud-based identities.
Facebook introduces subscription option for users in Europe
Facebook has announced that it will offer users in Europe the choice to continue using its personalized services for free with ads or subscribe to stop seeing ads. The subscription cost ranges from 10 to 13 euros per month, depending on the device used.
Criticism and legal challenges against Facebook's subscription model
The new subscription option has faced criticism and legal challenges. An Austrian privacy group has filed a complaint, arguing that the cost of the subscription is disproportionate to the value that Facebook derives from tracking users in the region. The group claims that the average revenue per user in Europe during the last 12 months was significantly lower than what Facebook suggests.
Don't minimise your Teams Meeting video call too hastily, you might reveal your dirty secrets! Would you be prepared to pay for Facebook and Instagram? And who is being faked to promote cryptocurrency scams?
All this and much more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by technology journalist Jane Wakefield.
Plus - don't miss our featured interview with Push Security founder and CEO Adam Bateman.
Warning: This podcast may contain nuts, adult themes, and rude language.
Push Security - Monitor and secure your entire identity attack surface, including non-SSO identities. Get notified in real-time to vulnerabilities across all your internet-facing identities, and have your staff guided to fix simple issues.
Kolide – Kolide ensures that if your device isn’t secure it can’t access your cloud apps. It’s Device Trust for Okta. Watch the demo today!
Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get 10% off!
SUPPORT THE SHOW:
Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.
Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!