InfoSec Bites

HelloInfoSec

Welcome to Hello InfoSec, your ultimate hub for all things cybersecurity! Dive into our thrilling podcast series, InfoSec Bites, where we unleash deep dives into Information Security, jaw-dropping Major Security Incidents, cutting-edge Cloud Information Security, crucial Privacy topics, revolutionary Artificial Intelligence, mind-bending Quantum Computing, and so much more! Get ready to geek out with expert insights and stay ahead of the curve—hit that like button, subscribe now, and turn on notifications for fresh episodes that will blow your mind! https://www.youtube.com/@HelloInfoSec

Play

Open in

21 episodes
weekly
Avg 47 min
English

Episodes 21

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

Sunday · 37 min
ISO/IEC 27018: Guidelines for Protecting PII in Public Clouds
ISO/IEC 27018 is the first international standard specifically designed to protect personally identifiable information (PII) in public cloud environments, acting as a specialized privacy extension to the foundational ISO/IEC 27001 Information Security Management System (ISMS). Tailored uniquely for cloud service providers (CSPs) acting as contractual PII processors, it translates the eleven privacy principles of ISO/IEC 29100 into concrete, cloud-native operational controls. The standard establishes strict technical and organizational accountability throughout the cloud data lifecycle, enforcing robust mechanisms for sub-processor transparency, geographical data residency disclosures, granular access controls, and automated tenant data purging. The standard's 2025 third edition modernized this framework, abandoning the legacy 18-section format of the 2019 version to align directly with the four-theme taxonomy—Organizational, People, Physical, and Technological controls—of ISO/IEC 27002:2022. While voluntary, implementing these guidelines provides a robust technical blueprint that helps cloud processors demonstrate compliance with prescriptive, legally binding regulations such as GDPR Article 28.
July 23 · 54 min
The Silent Layer: Unmasking Container Base OS Security in AWS Environments
This podcast discussion provides a technical deep dive into AWS Bottlerocket, a Linux-based, open-source operating system purpose-built by Amazon Web Services to host containerized workloads. Unlike general-purpose distributions that include thousands of packages, Bottlerocket follows a minimalist philosophy, stripping away package managers, scripting interpreters, and interactive shells to reduce the attack surface by approximately 60%. The architecture is rooted in immutability and defense-in-depth security. It enforces a read-only root filesystem verified through cryptographic digests (dm-verity) at boot, which prevents unauthorized runtime modifications and detects rootkit-based attacks. Security is further bolstered by SELinux in enforcing mode by default, kernel lockdown mechanisms, and support for hardware-based trusted computing. Operationally, Bottlerocket replaces traditional package-by-package updates with an atomic, image-based update model using A/B partitions. This mechanism enables single-step rollouts and rollbacks, eliminates "patch drift," and reduces update-related downtime by up to 80%. Performance benchmarks indicate superior efficiency, with faster node startup times (averaging under 39 seconds) and a 45% smaller memory footprint compared to traditional Linux environments. Management is handled through a secure, API-first approach. Direct host access is restricted; instead, administrative tasks are performed via isolated control and admin containers. The OS is optimized for major orchestrators like Amazon EKS and ECS, and it includes specialized variants for high-performance tasks, such as NVIDIA GPU-accelerated AI and machine learning workloads. Finally, the discussion explores Bottlerocket's role in meeting strict regulatory requirements. It is CIS hardened out-of-the-box, supports FIPS 140-3 validated cryptographic modules, and provides the architectural foundation for achieving PCI DSS compliance in cloud-native environments.
July 16 · 47 min
Web Application Attacks & Adversarial Lifecycle: From Passive OSINT to Lateral Movement and Multi-Layered Detection
Modern cybersecurity operations prioritize multi-layered reconnaissance, moving from passive OSINT gathering using tools like Amass and crt.sh to active verification via port profiling and directory enumeration. This initial phase aims to map the organization's external digital footprint, identifying exposed assets such as misconfigured subdomains, cloud storage buckets, and leaked credentials within public repositories. Once the attack surface is defined, adversaries leverage vulnerabilities like Server-Side Request Forgery (SSRF), SQL injection, and insecure deserialization to establish initial access and harvest temporary credentials from infrastructure metadata services. Following initial compromise, threat actors attempt privilege escalation through techniques such as "Potato-class" token impersonation or abusing overly permissive AWS IAM policies, often utilizing advanced agentic analysis frameworks for detection in complex polyglot microservices. Attackers then navigate the internal network via lateral movement, employing native tools like PsExec, PowerShell, and WMI while attempting to evade detection through credential dumping or token manipulation. Defending against these evolving threats requires a robust architecture that integrates NIST SP 800-61 incident handling guidelines with proactive measures like virtual patching, Web Application Firewalls (WAF), and the principle of least privilege. Furthermore, emerging technologies, including AI-driven log analysis and predictive shielding, enhance detection accuracy and enable real-time disruption of critical attack paths before a full domain compromise occurs.
July 9 · 44 min
Authentication and Authorisation bypass: The Invisible Threat
Access control serves as a foundational security framework divided into authentication, which verifies identity, and authorization, which regulates interaction boundaries between active subjects and passive resources. Despite its criticality, broken access control remains a top vulnerability, frequently exploited through mechanics such as Insecure Direct Object References (IDOR), parameter tampering, and architectural decoupling that allow attackers to bypass identity checks or escalate privileges. Modern technical shifts toward cloud-native systems, microservices, and AI agents have significantly expanded this attack surface, introducing complex failure modes like "Golden SAML" token forgery and task boundary drift, where legitimate sessions are manipulated to perform unauthorized actions. To mitigate these pervasive risks, enterprises must move beyond traditional perimeter defenses and adopt a Zero Trust posture centered on Attribute-Based Access Control (ABAC), the principle of least privilege, and continuous behavioral monitoring to detect the subtle logic flaws and design gaps that automated scanners often miss.
July 2 · 57 min
Remote Code Execution: Vulnerability Mechanics, Mitigation Bypassing, and Defensive Architecture
Remote Code Execution (RCE) represents the highest tier of security compromise, enabling unauthorized attackers to execute arbitrary commands or machine code on a system over a network boundary. These flaws reflect a fundamental failure to isolate untrusted data from the CPU’s instruction registers, effectively subverting the standard security boundaries of the Von Neumann execution model. The mechanics of RCE vary across runtime environments: native applications written in C or C++ are primarily vulnerable to memory corruption flaws, such as stack-based buffer overflows that overwrite return pointers to redirect execution. Conversely, managed environments like the Java Virtual Machine or Python typically experience RCE through high-level logic failures, including insecure deserialization—where "gadget chains" trigger commands during object reconstruction—or web framework exploits like OGNL injection and Server-Side Template Injection (SSTI) that manipulate internal evaluation engines. The impact of a successful RCE exploit is often catastrophic, leading to full system compromise, privilege escalation, and the lateral movement of attackers throughout an entire network. Landmark crises such as Log4Shell, EternalBlue, and the Apache Struts breach illustrate how these vulnerabilities facilitate massive data exfiltration and the automated propagation of ransomware like WannaCry. While defensive measures such as Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP), and stack canaries provide initial protection, attackers frequently bypass these using advanced techniques like Return-Oriented Programming (ROP) and memory leakage. Building a resilient architecture requires a defense-in-depth strategy that combines rapid patch management, strict input validation, the principle of least privilege, and network egress filtering to disrupt the multi-stage exploitation lifecycle.
June 25 · 50 min
Modernising Vulnerability Prioritisation via CISA KEV and BOD 26-04
The discussion in this podcast examines CISA’s Known Exploited Vulnerabilities (KEV) catalog and its evolving role in national cybersecurity policy. This authoritative registry identifies security flaws with confirmed evidence of active exploitation and clear remediation paths, serving as a critical tool for prioritizing defensive actions. Recent updates, specifically Binding Operational Directive (BOD) 26-04, move away from traditional severity scores toward a risk-based decision tree that mandates remediation in as little as three days for high-exposure assets. While these directives primarily govern federal agencies, the KEV catalog has become a de facto global benchmark for private industries, insurers, and medical device manufacturers. The discussion further compares this confirmed exploitation data with predictive models like the Exploit Prediction Scoring System (EPSS) to help organizations anticipate future threats. Collectively, we highlight a shift toward automated, evidence-driven vulnerability management to counter the speed of modern, AI-assisted cyberattacks.
June 18 · 35 min
Decoding NIST CSWP 41: Predicting Vulnerability Exploitation Metrics
The discussion in this podcast covers the introduction of the Likely Exploited Vulnerabilities (LEV) metric, proposed in NIST Cybersecurity White Paper 41 by Peter Mell and Jonathan Spring to address a critical gap in the "remediation deficit" where organizations can typically only patch a small fraction of annual CVEs. LEV functions as a retrospective, probabilistic score that compounds historical Exploit Prediction Scoring System (EPSS) data to estimate the cumulative likelihood that a vulnerability has already been exploited in the past, thereby correcting the "past-exploitation blindness" of forward-looking models. The metric is designed to complement rather than replace existing frameworks, offering use cases for measuring the comprehensiveness of the CISA Known Exploited Vulnerabilities (KEV) catalog and enhancing prioritization through a Composite Probability score—defined as the maximum signal of EPSS, LEV, and KEV. Technical advancements discussed alongside these metrics include the FORGE multi-agent system for automated exploit generation and Bayesian Network models for real-time, adaptive decision support in critical infrastructure. Despite its mathematical utility, the LEV framework has prompted significant industry debate regarding its "independent events" assumption, the validity of its LEV2 daily-linear approximation, and the risk of "triage inflation" by permanently elevating the priority of dormant legacy threats. Collectively, the discussion highlight a strategic shift toward evidence-driven exposure management and rigorous operational mandates, such as CISA BOD 26-04, which requires federal agencies to prioritize remediation based on active threat telemetry and forensic compromise checks.
June 11 · 36 min
EPSS: Leveraging the Exploit Prediction Scoring System (EPSS) to Reduce Remediation Workloads
The discussion in this podcast about paradigm shift in cybersecurity from traditional, static vulnerability management centered on the Common Vulnerability Scoring System (CVSS) toward dynamic, risk-based prioritization models that integrate global threat intelligence with local business context. This evolution is driven by an exponential surge in vulnerability disclosures—surpassing 25,000 annually and continuing to climb—which has created a critical crisis of alert fatigue and cognitive overload for security operations teams. Central to this transition are data-driven tools like the Exploit Prediction Scoring System (EPSS), which uses machine learning to forecast the 30-day probability of exploitation activity, and the CISA Known Exploited Vulnerabilities (KEV) catalog, which provides high-confidence validation of active threats. Modern research advocates for Vulnerability Management Chaining (VMC) and integrated frameworks that layer these global signals with asset criticality, reachability, and exposure to filter out the "noise" of non-exploitable vulnerabilities; evaluations of these methods show they can reduce urgent remediation workloads by up to 95% while maintaining over 85% threat coverage. Ultimately, the sources emphasize that while global scoring systems provide essential "pre-threat intelligence," effective exposure management requires local calibration, AI-powered autonomous investigation, and a broader industry move toward secure-by-design principles to address the increasingly fragmented attack surface of hybrid cloud environments.
June 6 · 48 min
Navigating the Modern Vulnerability Landscape: Leveraging CVSS v4.0, CISA Vulnrichment, and AWS-Native Intelligence
The discussion in this podcast explores the evolving landscape of modern vulnerability management, focusing on the critical shift from technical severity scoring in CVSS v3.1 to the contextual, risk-oriented approach of CVSS v4.0. They detail the foundational governance of the CVE Program and the operational workflows of the National Vulnerability Database (NVD), while addressing the 2024–2026 NIST enrichment backlog that has driven the rise of alternative frameworks like CISA’s Vulnrichment and Stakeholder-Specific Vulnerability Categorization (SSVC). A significant portion of the podcast provides technical guidance for architecting continuous security within the AWS Security Reference Architecture (SRA), specifically demonstrating how Amazon Inspector correlates standardized CVSS base scores with real-time environmental telemetry to produce actionable, prioritized risk findings. Finally, the dicussion contrast cloud-native capabilities with enterprise scanners from Qualys, Tenable, and Rapid7, illustrating how diverse threat intelligence feeds and machine learning are employed to overcome the limitations of static scoring and effectively manage global exposure.
May 27 · 33 min
NIST Privacy Framework and Regulatory Compliance
The dicussion in this podcast outlines how the NIST Privacy Framework can be utilised to align corporate risk management with various international data protection regulations. By employing regulatory crosswalks, organisations can map specific legal mandates from the GDPR, CCPA, and other state-level statutes to a unified set of internal controls. The discussion emphasizes a structured governance approach involving five core functions: identify, govern, control, communicate, and protect. Practical examples demonstrate how to translate legal requirements, such as the right to erasure or data mapping, into operationalised technical standards. Ultimately, these resources serve as a guide for building a future-proof privacy program that integrates compliance directly into business processes. This strategic alignment ensures that companies remain legally compliant while effectively managing the inherent risks of data processing.
May 21 · 40 min
NIST Container Security and Compliance Frameworks Guide
In this podcast we discuss NIST Special Publication 800-190, a comprehensive federal guide dedicated to application container security. This publication defines containers as a form of operating system virtualization that enables the portable and efficient packaging of software. The podcast details a multi-tiered architecture comprising images, registries, orchestrators, and host operating systems, identifying specific security risks inherent to each layer. To mitigate these threats, the guide proposes practical countermeasures, such as using minimalist host operating systems and automated vulnerability management. Ultimately, the documentation provides a lifecycle framework to help organisations securely plan, implement, and maintain containerised environments.
May 14 · 45 min
A Guide to the NIST Risk Management Framework
The NIST Risk Management Framework (RMF), primarily detailed in Special Publication 800-37, serves as a comprehensive methodology for securing information systems throughout their entire functional lifespan. This structured process guides organisations through seven essential stages: preparing the enterprise, categorising data based on impact, selecting and implementing safeguards, and then assessing, authorising, and monitoring those protections. The updated Revision 2 specifically integrates privacy management and supply chain security to address modern digital threats and complex global vulnerabilities. By aligning with the NIST Cybersecurity Framework, it ensures that senior leadership and operational staff maintain clear communication regarding institutional risks. Furthermore, the framework encourages the use of automation and continuous monitoring to create a more efficient, cost-effective path toward maintaining a secure Authority to Operate. Ultimately, the RMF provides a flexible, risk-based approach applicable to any technology or organisation seeking to protect its assets and individual privacy.
May 7 · 59 min
Logging Monitoring and Audit in Cloud Environment
In this episode we explore the critical role of monitoring and logging solutions in maintaining the security and performance of modern cloud infrastructures. We will discuss the functionality of Azure Monitor activity logs, explaining how they track management operations and facilitate auditing or alerting for resource changes. A case study from the Cloud Security Alliance examines the 2024 Snowflake data breach, highlighting how failures in identity management and baseline security monitoring can lead to massive exfiltration. Research from the International Journal for Multidisciplinary Research provides empirical data on the benefits of centralised logging, showing that machine learning and automation significantly improve anomaly detection and reduce troubleshooting time. Together, these it emphasise that real-time visibility and scalable diagnostic tools are indispensable for identifying threats and ensuring operational resilience in complex digital environments.
April 30 · 36 min
Risk Assessment in Cyber Security
The discussion in this podcast explores cybersecurity risk assessment as a vital strategic capability for modern organizational resilience. It centers on three primary global frameworks: NIST SP 800-53, which provides granular technical controls; ISO 27005/31000, offering principles-based international standards; and COBIT 2019, which focuses on enterprise IT governance. By examining these methodologies, it illustrates how they converge to transform abstract threats into measurable business risks that inform executive decision-making. High-profile case studies, such as the SolarWinds and Equifax breaches, are analyzed to demonstrate the catastrophic operational and financial costs of failing to maintain rigorous assessment practices. Ultimately, the hosts argues that a mature, framework-aligned approach goes beyond mere regulatory compliance to create a genuine competitive advantage through enhanced trust and business continuity. The discussion serves as a guide for security professionals to align technical security measures with overarching corporate strategy.
April 23 · 45 min
Risk Governance in Cyber Security: Foundations and Frameworks
The discussions in this podcast serves as a comprehensive manual on cybersecurity risk governance, emphasizing its role as the strategic blueprint for resilient enterprise security. It explores the historical evolution of the field, tracing its growth from simple physical server protection to a critical board-level imperative driven by global regulations. The discussion provides a meticulous deep dive into the world’s "gold standard" frameworks—NIST, ISO, and COBIT—analyzing how they overlap and where they diverge in technical granularity. Detailed case studies of major breaches, such as Equifax and SolarWinds, illustrate how specific governance failures lead to catastrophic financial and operational loss. Ultimately, the hosts argues that structured risk management transcends mere compliance, creating a mature security culture that is essential for navigating modern geopolitical and digital threats.
April 16 · 48 min
Cloud Forensic : Trustworthiness of Digital Evidence in Cloud Environments
In this podcast we discuss a systematic literature review investigating the legal and technical hurdles of cloud-based digital forensics. The discussion highlights that traditional investigative methods often fail in cloud environments due to data volatility, distributed storage across multiple jurisdictions, and a reliance on third-party service providers. By analyzing 32 core studies published between 2020 and 2023, it identifies a critical need for standardized frameworks and unified international regulations to ensure the admissibility of evidence in court. Proposed solutions include the integration of blockchain technology for securing the chain of custody and the development of specialized tools to handle multi-tenant infrastructures. Ultimately, the work serves as an update on the state of the field, emphasizing the importance of forensic readiness among cloud providers to combat increasing criminal activity.
April 9 · 1 hr 15 min
VM Escape in Cloud: Hypervisor Security and the Evolution of Virtual Isolation
In this podcast we examine the complex security landscape of virtualization and bare metal cloud environments, focusing on the critical threat of Virtual Machine (VM) escape vulnerabilities. The discussion detail high-risk exploits like CVE-2025-22224, which target hypervisor race conditions, and discuss hardware-level risks such as firmware rootkits and microarchitectural side-channels. To counter these threats, the materials highlight diverse defensive frameworks, including the AWS Nitro System’s hardware offloading, Google Cloud’s Shielded VMs with verified boot, and Azure’s Confidential Computing for memory encryption. Additionally, we explore the use of Falco for runtime detection and the performance-security trade-offs inherent in AI-driven infrastructure. Ultimately, the discussion advocate for a layered defense strategy that integrates rigorous patching, hardware-based roots of trust, and continuous monitoring to maintain multi-tenant isolation.
April 2 · 55 min
VM and Resource Sprawl: Mastering Cloud Efficiency
This podcast collectively define and address the challenges of cloud and virtual machine sprawl, emphasizing the necessity of cost optimization and robust security governance. It explain that rapid, unmonitored resource deployment leads to financial waste, performance lags, and expanded attack surfaces for cyber threats. To mitigate these risks, the authors recommend a FinOps framework characterized by cross-team accountability, continuous monitoring, and the automation of lifecycle management. Practical strategies such as rightsizing compute resources, implementing tagging policies, and utilizing automatic shutdown scripts are highlighted as essential for maintaining efficiency. Furthermore, specialized tools from providers like Wiz, IBM, and AWS are discussed as solutions for gaining the visibility required to eliminate zombie resources and orphaned data. Ultimately, it advocates for a culture of continuous optimization where financial responsibility and infrastructure security are integrated into the development lifecycle.
March 26 · 50 min
Zero-Click Attacks: The Invisible Cyber Threats
In this episode we examine the rise of zero-click hacking, a sophisticated cyber threat that compromises devices through unpatched software flaws without requiring any user interaction. Unlike traditional phishing, these attacks exploit "zero-day" vulnerabilities in messaging apps and operating systems to silently install spyware like Pegasus. High-profile case studies, such as Operation Triangulation, illustrate how attackers use malicious data packets to gain total control over mobile hardware and sensitive data. Technical deep dives reveal the extreme complexity of these exploits, which can even emulate entire computer architectures within an image processor. To combat these invisible dangers, it highlight industry responses ranging from Apple's security patches to Samsung’s "Message Guard" sandboxing technology. Ultimately, the collective research emphasizes that maintaining rigorous software updates and advanced endpoint monitoring is essential for defending against modern surveillance.
March 20 · 41 min
Crypto-Shredding: Cloud Data Sanitization and Quantum Security Strategies
In this Podcast we discuss crypto-shredding, a data sanitization method where information is rendered unreadable by permanently destroying its encryption keys. This technique is essential for cloud computing environments because users lack physical access to hardware, making traditional disk destruction impossible. While the process is fast and scalable, it relies heavily on flawless key management and faces potential long-term risks from quantum computing advancements. Real-world incidents, such as those involving Morgan Stanley and Google, illustrate how configuration errors or poor oversight can lead to catastrophic data loss or unintended exposure. To maintain security, organizations are encouraged to use customer-managed keys and transition toward post-quantum cryptography to protect against future decryption threats. Ultimately, frame crypto-shredding as a powerful but complex tool that requires rigorous governance and frequent auditing to be effective.

Showing 1–20 of 21 episodes