8th Layer Insights

Risk is a funny thing – our minds are constantly looking for risk, scanning our environments and our available choices. And sometimes we do a great job at anticipating and avoiding risky situations. But that doesn’t mean that we are universally good at dealing with risk. In fact, we can be downright appalling at considering and avoiding risk.In this episode, we explore the concept of risk, why we're so bad at understanding it, and the steps we can take to improve. Perry speaks with four risk experts who will help us understand the ups and downs of how we evaluate risk. We’ll touch on everything from Black Swans to Grey Rhinos to risk frameworks, risk equations, inbuilt risk in the design of computing interfaces, and more. Featuring Michele Wucker (author of The Grey Rhino and You Are What You Risk), Christian Hunt (Founder of Human Risk), Dr. Arun Vishwanath (Founder and Chief Technology Officer of Avant Research Group), and Matt Stamper (Chief Information Security Officer and Executive Advisor at EVOTEK and co-author of the CISO Desk Reference Guides vol1 & vol2).Original release date: Aug 31, 2021.Guests: Michele Wucker Christian Hunt Arun Vishwanath Matt Stamper Resources & Books: Black Swan Theory Grey Rhino Events Various Risk Equations Risk Perception Equation, Freakonomics 20 Cognitive Biases That Affect Risk Decision Making, SafetyRisk.net Factor Analysis of Information Risk (FAIR) Framework The Gray Rhino: How to Recognize and Act on the Obvious Dangers We Ignore, by Michele Wucker (Amazon Affiliate Link) You Are What You Risk: The New Art and Science of Navigating an Uncertain World, by Michele Wucker (Amazon Affiliate Link) Why are Humans Bad at Calculating Risk?, Cogency Why You're Probably Not So Great at Risk Assessment, NY Times Why the Human Brain is a Poor Judge of Risk, Wired Humans are Terrible at Assessing Risk, by Kimberly Forsythe Why We're Awful at Assessing Risk, USA Today CISO Desk Reference Guides vol1 & vol2, by Bill Bonney, Gary Hayslip, Matt Stamper (Amazon Affiliate Link) Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter (Amazon Affiliate Link) The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer (Amazon Affiliate Link) Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks.Artwork by Chris Machowski. Learn more about your ad choices. Visit megaphone.fm/adchoices

What images come to mind when you see or hear the word 'Cybersecurity?' That word probably evokes mental images of people hunched over keyboards launching cyberattacks at each other. Or maybe you picture someone picking a lock or stealing a badge to slip into a building. In other words, most people picture the battle... or what some might think of as "the fun parts." But, here's the thing. Not everyone gets to participate in these aspects of cybersecurity and, in many cases, finding safe and legal ways to practice these skills can be challenging. So where can curious minds turn?That's where gamification can really help. There are a ton of really fun and engaging ways to learn these skills without fear of being arrested or breaking something. These are also great ways to level-up cybersecurity skills and help bring new people into the field. In this episode, we explore the "fun and games" of cybersecurity: lock picking, (CTFs) capture the flag competitions, simulations, and even pickpocketing and magical (sleight of hand and misdirection) thinking.Perry's guests are Alethe Denis (social engineer and DefCon 2019 Social Engineering CTF winner), Deviant Ollam (penetration tester, lock picking guru, and Board Member of The Open Organization of Lockpickers), Chris Kirsch (Co-Founder and CEO of Rumble, DefCon 2017 Social Engineering CTF winner) , and Gerald Auger (Founder of Simply Cyber, Director of Cybersecurity Education & Cybersecurity Program Manager at ThreatGEN).Guests: Alethe Denis (LinkedIn) (Twitter) (Website) Deviant Ollam (Twitter) (YouTube) (Website) Chris Kirsch (LinkedIn) (Twitter) Gerald Auger (LinkedIn) (Twitter) (YouTube) Resources & Books: What is Gamification? Lockpicking Resources from Deviant Ollam Keys to the Kingdom: Impressioning, Privilege Escalation, Bumping, and Other Key-Based Attacks Against Physical Locks, by Deviant Ollam Practical Lock Picking: A Physical Penetration Tester's Training Guide, by Deviant Ollam TOOOL US -- The Open Organization of Lockpickers TOOOL US instructional videos on YouTube The Official TOOOL Slides The Lockpicking Lawyer on YouTube Bump Keys in the News - San Francisco #3 -- YouTube clip TraceLabs OSINT Capture the Flags 50 CTF (Capture the Flag) & Pentesting Websites to Practice Your Hacking & Cybersecurity Skills in 2021 Hands-on Hacking Demo | CTF - Capture the Flag in 15 Minutes!, YouTube video by ITProTV Capture the Flag? Change Your Life, YouTube video by John Hammond Don’t Wait for the Perfect Time for a Tabletop Exercise, National Law Review ThreatGEN's Red & Blue Game Gerald Auger's Simply Cyber Discord Server Chris Krisch's pickpocketing talk at Layer8 Security Conference Production Credits:Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks.Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com.8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com Learn more about your ad choices. Visit megaphone.fm/adchoices

If you love learning about cons, scams, and tricks, then this is the episode for you. Listen as Perry sits down with Brian Brushwood, someone who has made understanding and teaching scams and tricks his life's work. Brian is the creator of Scam School, Scam Nation, Hacking the System, Modern Rogue, and more. For the past 20 years, he's toured around the world teaching and demonstrating everything from side show stunts, to sleight-of-hand magic, to the intricacies of con artistry.Brian’s new podcast, World’s Greatest Con is a deep-dive into the stories and tactics behind the most intricate and interesting cons imaginable. In season 1, he told the story of Operation Mincemeat, a WWII plot devised by Ian Fleming (creator of James Bond) to trick none other than Adolf Hitler. Season 2 covers five different cons all related to the game show industry… it’s both entertaining and riveting in some very unexpected ways.A big thank you to my friends over at the PodCube podcast for creating a custom skit for this episode. If you are a fan of sketch comedy, be sure to check out their show! (PodCube: The Future, is Yesterday™).Guest: Brian Brushwood (Website) (Twitter)Books and Resources Brian's Website World's Greatest Con podcast site Scam School YouTube Channel Modern Rogue YouTube Channel Brian Brushwood Mistreats His Tongue Brian doing psychic surgery on Penn & Teller: Fool Us Brian doing the "hidden ghost" trick Brian's Entire Bizarre Magic Stage Show How to make a fake tongue (without using a deer tongue) Operation Mincemeat -- Wikipedia 13 Unbelievably Fascinating Game Show Cheating Scandals That'll Shock Both Devoted And Casual Fans -- Buzzfeed Project Alpha -- Wikipedia Going Mental: A Conversation with Banachek -- 8th Layer Insights S1E7 PodCube Podcast Thinking, Fast and Slow by Daniel Kahneman  Influence, New and Expanded: The Psychology of Persuasion by Robert Cialdini Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits: The opening skit featured the voice talents of Rich Daigle (a.k.a. Mouth Almighty), Hannah Trusty, Adriana Beals, and Rob McCollum. Writing support for this episode's opening section from Terry Hicks Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks. Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com. 8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com Learn more about your ad choices. Visit megaphone.fm/adchoices

Every now and then you need to try something new. That's what this episode is. If you listened to Season 2, Episode 3 (Technology and the Law of Unintended Consequences), you may remember the mock interview with Janet, the virtual assistant. This episode expands that idea and features a set of four mock interviews -- all with security-related object. This is an interesting experiment to help flesh-out some ideas behind these objects, the reasons they exist, their motivations, and the situations in which they find themselves.On this episode, we have four guests: Samantha, a piece of facial recognition software with a really interesting idea, Dave the password who has a pretty bad sharing problem, Devon, a secure email gateway who is struggling with the weight of the world and Barb, the phishing email who will say just about anything possible to get you to click that link.Guests:  Samantha – Facial Recognition Software Dave – Password Devon – Secure Email Gateway Barb – Phishing Email Books and Resources: MasterClass -- Margaret Atwood Teaches Creative Writing "Everything is Alive" Podcast Krebs on Security - Password Do’s and Don’ts What makes a good password? 9 rules to protect you from cyberattacks World Password Day: Roger Grimes on passwords Q&A With Data-Driven Evangelist Roger Grimes on the Great Password Debate How does facial recognition work? Facial recognition: top 7 trends (tech, vendors, use cases) NISTIR 8238 Ongoing Face Recognition Vendor Test (FRVT) Part 2: Identification How Accurate are Facial Recognition Systems – and Why Does It Matter? Social Engineering Red Flags Email Security Gap Analysis Shows 10.5% Miss Rate What are Email Security Gateways, How Do They Work, and What Can They Offer Your Organization? The Creative Writing Coursebook: 40 Authors Share Advice and Exercises for Fiction and Poetry On Writing: A Memoir of the Craft by Stephen King Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits:Additional voice talent provided by Luna Freyava, Rich Daigle (a.k.a. Mouth Almighty), Punyaha Mukherjee, and Tabitha GarlandMusic and Sound Effects by Blue Dot Sessions, Envato Elements, & SmartSoundArtwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com.8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com Learn more about your ad choices. Visit megaphone.fm/adchoices

On this episode, Perry sits down with James Linton (formerly known as The Email Prankster). In 2017, James went on a virtual joyride exploiting the ways that people interact with emails. One of the most interesting things about James' story is that his exploits didn't rely on any type of highly technical method(s); they were simple display name deceptions. But that didn't stop him from fooling CEOs from some of the worlds largest banks, celebrities, and high ranking staff members in the White House.James' success using these simple methods serves as a warning for us all. We don't fall for scams because they are technically sophisticated or because we are stupid. We fall for scams because we are human.Guest: James Linton (LinkedIn) (Website)Books and Resources: Anatomy Of An Email Impersonation Spree: Who Got Pranked And Why An email prankster is hitting the CEOs of the world's biggest banks How to Prank the Rich and Powerful Without Really Trying Morgan Stanley CEO James Gorman falls for email prank This Man Pranked Eric Trump And Harvey Weinstein — Now He Just Wants A Job Media Coverage YouTube Playlist James Linton -- Wikipedia Entry The Journal of Best Practices: A Memoir of Marriage, Asperger Syndrome, and One Man's Quest to Be a Better Husband by David Finch Perry -- Interview on Springbrook's Converge Autism Radio Perry -- Security Weekly Interview Perry Carpenter - The Aspies Guide to Social Engineering - DEF CON 27 Social Engineering Village Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer Production Credits:Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks.Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com.8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com Learn more about your ad choices. Visit megaphone.fm/adchoices

If you've been following the cybersecurity industry for the past few years, you've likely heard about the "cyber skills gap." In this episode, Perry sits down with Heath Adams (TCM Security), Professor Karla Carter (Bellevue University), Sam Curry (Cybereason), and Lola Obamehinti (eBay) to explore what the skills gap is and how to begin to close the gap. We touch on subjects such as where traditional degrees, online training, certifications, mentorship, and networking fit in, as well as the value of diversity. And we offer thoughts for employers, current industry professionals, and job seekers.Guests: Heath Adams (LinkedIn) Karla Carter (LinkedIn) Sam Curry (LinkedIn) Lola Obamehinti (LinkedIn) Books and Resources: Confident Cyber Security: How to Get Started in Cyber Security and Futureproof Your Career, by Dr. Jessica Barker Cybersecurity Domain Map ver 3.0 by Henry Jiang Cybersecurity Employment in 2022: Solving the Skills Gap, by Jenn Fulmer Cybersecurity: The Starting Line, by 4n6Lady The 8 CISSP domains explained, by Luke Irwin Examination of Personality Characteristics Among Cybersecurity and Information Technology Professionals, by Sarah E. Freed (utc.edu) GenCyber Camps: Inspiring the Next Generation of Cyber Stars NSA National Centers for Academic Excellence in Cybersecurity Navigating the Cybersecurity Career Path by Hellen E. Patton Over 200,000 Girl Scouts Have Earned Cybersecurity Badges by Ashley Savageau Tribe of Hackers: Cybersecurity Advice from the Best Hackers in the World, by Marcus J. Carey & Jennifer Jin The Value of Certifications, by Javvad Malik Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter Word Notes Podcast definition of Cybersecurity Skills Gap Production Credits:Additional voice talent provided by Rich Daigle.Additional research by Nyla Gennaoui.Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks.Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com.8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/*** Use of The Twilight Zone theme music in this episode is considered 'Fair Use' under copyright law due to its 'transformative' nature as a parody.Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com Learn more about your ad choices. Visit megaphone.fm/adchoices

Let's face it. Most of us have a love/hate relationship with technology and technological advances. We dream about the new thing... but when it arrives, we are usually a little disappointed. Many of us also lament the constant erosion of privacy, the changes in social norms, and more. And, little-by-little, we allow those aspects of new technology to make us numb. We accept the cognitive dissonance of not totally being happy with the trade-offs; yet we still make the trade.In this episode, we explore a few of the positives and some of the unintended consequences associated with recent technological advancements. We'll hear from Dr. Lydia, Kostopoulos, Dr. Charles Chaffin, Andra Zaharia, and Aaron Barr.Guests: Dr. Lydia Kostopoulos (LinkedIn) (Website) Dr. Charles Chaffin (LinkedIn) (Website) Andra Zaharia (LinkedIn) (Website) Aaron Barr (LinkedIn) (Website) Books and Resources: Everything is Alive by PRX and Radiotopia IEEE Article: Decoupling Human Characteristics from Algorithmic Capabilities by Dr. Lydia Kostopoulos Numb: How the Information Age Dulls Our Senses and How We Can Get them Back by Dr. Charles Chaffin The Numb Podcast by Dr. Charles Chaffin The Cyber Empathy Podcast by Andra Zaharia Reminder: Your 'smart AI' often involves a low-paid contractor surveilling you How creepy is your smart speaker? Newton's Laws of Motion Unintended Consequences Elon Musk's warning regarding AI Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors Production Credits:Additional voice talent provided by Kristina Leigh.Additional research by Nyla Gennaoui.Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks.Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com.8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/Want to get in touch with Perry? Here's how: LinkedIn Twitter Instagram Email: hello [at] 8thLayerInsights [dot] com Learn more about your ad choices. Visit megaphone.fm/adchoices

And now for something completely different. This episode is a show within a show.Get ready to step into The Dark Stream: it's a parody of one of those old late night paranormal, conspiracy, or confession call-in radio shows from the 1980's and 90's. And, yes, it's over-the-top and cheesy.In this episode, you'll hear some re-edited and never before aired sections from Perry's previous interviews with Rachel Tobac, Maxie Reynolds, and Chris Hadnagy.Guests: Rachael Tobac: (LinkedIn), CEO of SocialProof Security Maxie Reynolds (LinkedIn), Founder of Subsea Cloud Chris Hadnagy: (LinkedIn); CEO of Social Engineer, LLC; Founder of Innocent Lives Foundation; Founder of Social-Engineer.org Recommended Books and Resources: CNN coverage of Rachel Tobac using social engineering to ruin Donie O'Sullivan's day Human Hacking: Win Friends, Influence People, and Leave Them Better Off for Having Met You by Chris Hadnagy The Art of Attack: Attacker Mindset for Security Professionals by Maxie Reynolds Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter Production Credits:Additional voice talent provided by Rich Daigle (a.k.a. Mouth Almighty) and Sarah McQuigganMusic and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks.Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com.8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Learn more about your ad choices. Visit megaphone.fm/adchoices

This episode is all about creativity: what it is, what it looks like, and what to do when you get stuck. Perry speaks with four experts who have made creating new and interesting things their life's work. Featuring Jack Rhysider (Creator/host of Darknet Diaries), Faith McQuinn (creator of Boom, Margaritas & Doughnuts, and Apollyon), Tom Buck (YouTuber and content creator), and Sam Qurashi (Exploring the Psychology of Everything).Guests: Jack Rhysider Faith McQuinn Tom Buck Sam Qurashi Resources & Books: The No. 1 Habit of Highly Creative People Alchemy: The Dark Art and Curious Science of Creating Magic in Brands, Business, and Life Seven Techniques For Getting Creatively Unstuck The Unusual Habits Of 8 Famous Creative Minds The World's Most Creative People Have This Thing in Common You Are an Artist: Assignments to Spark Creation Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors Additional research by Nyla Gennaoui.Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks.Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com.8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/ Learn more about your ad choices. Visit megaphone.fm/adchoices

This is the second of a two part series covering Cybersecurity’s ABCs: Security Awareness, Behavior, and Culture. This episode discusses the difficulty that security leaders have in defining what a security culture actually is. Luckily, we can draw on learnings from organizational culture management and culture transformation experts.Guests for this episode include, David Sturt, Executive Vice President of the O.C. Tanner Institute, author of Great Work: How to Make a Difference People Love and Appreciate: Celebrating People, Inspiring Greatness., Dr. Jessica Barker (co-CEO and Co-Founder, Socio-Technical Lead at Cygenta; author of Confident Cyber Security and co-author of Cybersecurity ABCs), Kai Roer, Chief Research Officer at KnowBe4, creator of the Security Culture Framework, author of Build a Security Culture, and Michael Leckie, founding partner at Silverback Partners, LLC and author of The Heart of Transformation: Build the Human Capabilities that Change Organizations for Good.Guests: David Sturt Dr. Jessica Barker Kai Roer Michael Leckie References, Resources & Books: 4 Ways to Build a Thoughtful Security Culture, by Perry Carpenter 7 Tips for Building a Strong Security Culture, by Perry Carpenter Appreciate: Celebrating People, Inspiring Greatness, by David Sturt Build a Security Culture, by Kai Roer Confident Cyber Security: How to Get Started in Cyber Security and Futureproof Your Career, by Jessica Barker Culture Rules! The 10 Core Principles of Corporate Culture, by John R. Childress Cybersecurity ABCs: Delivering awareness, behaviours and culture change, by Jessica Barker, Adrian Davis, and Bruce Hallas Great Work: How to Make a Difference People Love, by David Sturt The Heart of Transformation: Build the Human Capabilities that Change Organizations for Good,, by Michael Leckie The Importance Of A Strong Security Culture And How To Build One, by Perry Carpenter Perry Carpenter's (ISC)2 Info Security Professional Journal 4 episode series on Security Awareness (Episode 1, Episode 2, Episode 3, Episode 4) Security Culture and Credential Sharing, KnowBe4 Research Security Culture Report 2021: A Global Security Culture Perspective During a Pandemic, KnowBe4 Research Seven Dimensions of Security Culture, KnowBe4 Research Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks.Artwork by Chris Machowski. Learn more about your ad choices. Visit megaphone.fm/adchoices