Sherrod DeGrippo, Director of Threat Intelligence Strategy at Microsoft and Host of The Microsoft Threat Intelligence Podcast, joins Nic Fillingham on this week's episode of The BlueHat Podcast. Sherrod is a frequently cited threat intelligence expert in media, including televised appearances on the BBC news and commentary in the Wall Street Journal, CNN, New York Times, and more. She is a well-known public speaker, having presented at Black Hat, RSA Conference, RMISC, BrunchCon, and others. Sherrod and Nic discuss various topics, including different types of threat actors, the overlap between nation-state actors and cybercrime, and Sherrod's fascination with cybercrime, emphasizing cybercriminals' creativity and ingenuity, particularly those who use social engineering techniques. In This Episode You Will Learn: Why many cybercriminals don't believe they are engaging in criminal activity How understanding a threat actor's psychology is essential to creating detection methods The importance of maintaining proper security hygiene Some Questions We Ask: How can threat actors operate with impunity? Should individuals and small businesses worry about nation-state threat actors? Can we reform and convince cybercrime groups to use their talents for good? Resources: View Sherrod DeGrippo on LinkedIn View Wendy Zenone on LinkedIn View Nic Fillingham on LinkedIn Discover and follow other Microsoft podcasts at microsoft.com/podcasts Hosted on Acast. See acast.com/privacy for more information.

Giovanni Cherubin and Ahmed Salem join Nic Fillingham and Wendy Zenone on this week's episode of The BlueHat Podcast. Giovanni is a Senior Researcher in Machine Learning and Security at Microsoft Research Cambridge, and Ahmed is a researcher in Confidential Computing at the Microsoft Research lab in Cambridge, UK. They're both interested in artificial intelligence and are researching the privacy, security, fairness, and accountability risks of the different machine learning settings. In this episode, they discuss how to identify and address privacy threats in machine learning models, the connection between privacy and information leakage, and how privacy is perceived in academia and industry.In This Episode You Will Learn: Algorithmic procedures for describing threats and attacksThe rapid growth of machine learning research in attacks and defenseThe framework for fostering collaboration and understanding within the fieldSome Questions We Ask: What are the main threats you are currently focused on? Who will benefit from this research besides academics and researchers?Can you explain the concept of privacy as it relates to information leakage?Resources: View Giovanni Cherubin on LinkedInView Ahmed Salem on LinkedInView Wendy Zenone on LinkedInView Nic Fillingham on LinkedInDiscover and follow other Microsoft podcasts at microsoft.com/podcasts Hosted on Acast. See acast.com/privacy for more information.

Hyrum Anderson and Ram Shankar join Nic Fillingham and Wendy Zenone on this week’s episode of The BlueHat Podcast. Hyrum Anderson is a distinguished ML Engineer at Robust Intelligence. He received his Ph.D. in Electrical Engineering from the University of Washington, emphasizing signal processing and machine learning. Much of his technical career has focused on security, and he has directed research projects at MIT Lincoln Laboratory and Sandia National Laboratories. Ram Shankar works on the intersection of machine learning and security at Microsoft and founded the AI Red Team, bringing together an interdisciplinary group of researchers and engineers to proactively attack AI systems and defend them from attacks. In This Episode You Will Learn: The difference between AI and machine learningWhy embracing a holistic, healthy AI development is to our advantageThe security vulnerabilities and risks associated with AI and Machine LearningSome Questions We Ask: Who did you write this book for, and what will the readers learn? What type of vulnerabilities are you finding the most concerning currently? How do adversarial attacks exploit vulnerabilities in AI algorithms?Resources: View Hyrum Anderson on LinkedInView Ram Shankar on LinkedInView Wendy Zenone on LinkedInView Nic Fillingham on LinkedInNot with a Bug, But with a Sticker is available hereFollow Hyrum on TwitterFollow Ram on TwitterDiscover and follow other Microsoft podcasts at microsoft.com/podcasts Hosted on Acast. See acast.com/privacy for more information.

Amanda Rousseau, Offensive Security Engineer for the Microsoft Offensive Research and Security Engineering Team, joins Nic Fillingham and Wendy Zenone on this week's episode of The BlueHat Podcast. Amanda loves malware; she worked as an Offensive Security Engineer on the Red Team at Facebook, a Malware Researcher at Endgame, and the U.S. Department of Defense Cyber Crime Center. Amanda mainly focuses on vulnerability, research fuzzing, and security engineering and discusses with Nic and Wendy her time reviewing and analyzing offline digital devices, known as Dead-Box Forensics, reverse engineering malware, and how she finds success from her creative and artistic background. In This Episode You Will Learn: What "shift left" means as a security professional How to learn more about fuzzing and understand some of the tooling Why having a creative background helps when communicating with security teams Some Questions We Ask: How would you describe fuzzing for someone that's doesn't know the definition? What is Dead-Box Forensics, and can you share the investigative process? How can we make fuzzing and security more accessible and less intimidating for developers? Resources: View Amanda Rousseau on LinkedIn View Wendy Zenone on LinkedIn View Nic Fillingham on LinkedIn Follow Amanda on Twitter and malwareunicorn.org Discover and follow other Microsoft podcasts at microsoft.com/podcasts Hosted on Acast. See acast.com/privacy for more information.

Michael Hendrickx, Principal Security Engineering Manager at Microsoft, joins Nic Fillingham and Wendy Zenone on this week's episode of The BlueHat Podcast. Michael works in Azure security at Microsoft and leads a team focused on conducting penetration tests on Azure services. The team draws inspiration from the bug bounty community and external sources, leveraging their insights and findings for their research. Michael also discusses the curiosity and exploration mindset needed for both engineers and researchers when it comes to investigating and discovering security vulnerabilities, how developers can effectively protect sensitive data transmitted over insecure networks, and the potential risks and challenges associated with third-party integrations in web applications. In This Episode You Will Learn: Server-side request forgery and its importance in the context of securityPotential security vulnerabilities associated with different parts of a URIImportance of collaboration, knowledge sharing, and investigation among developersSome Questions We Ask: What is the focus and target audience for "Shift Left?" Should researchers engage in URL manipulation to identify potential vulnerabilities?What security vulnerabilities should developers be aware of when designing web applications?Resources: View Michael Hendrickx on LinkedInView Wendy Zenone on LinkedInView Nic Fillingham on LinkedInDiscover and follow other Microsoft podcasts at microsoft.com/podcasts Hosted on Acast. See acast.com/privacy for more information.