Three Buddy Problem

Security Conversations

The Three Buddy Problem is a popular Security Conversations podcast that goes beyond industry talking points to discuss what others won’t -- nation-state malware, attribution, cyberwar, ethics, privacy, and the messy realities of securing computers and corporate networks. Hosted by three veteran security pros -- journalist Ryan Naraine and malware paleontologists Costin Raiu and Juan Andres Guerrero-Saade -- the weekly show attracts a highly engaged audience of security researchers, corporate defenders, CISOs, and policymakers. Connect with Ryan on Twitter (Open DMs).

Subscribe Listen in podnod RSS feed Show website

235 episodes
Updated Friday

Episodes235

Newest first

Jan 19, 2024 · 29 min
Katie Moussouris on building a different cybersecurity businesses
Episode sponsors: - Binarly, the supply chain security experts (https://binarly.io) - FwHunt (https://fwhunt.run) Katie Moussouris founded Luta Security in 2016 and bootstrapped it into a profitable business with a culture of equity and healthy boundaries, proving that businesses can be profitable by putting people first. She is a pioneer in the world of bug bounties and vulnerability disclosure and serves in multiple advisory roles for the U.S. government, including the new CISA Cyber Safety
Jan 15, 2024 · 1 hr 32 min
Costin Raiu: The GReAT exit interview
Episode sponsors: - Binarly, the supply chain security experts (https://binarly.io) - FwHunt (https://fwhunt.run) Costin Raiu has spent a lifetime in anti-malware research, working on some of the biggest nation-state APT cases in history, including Stuxnet, Duqu, Equation Group, Red October, Turla and Lazarus. In this exit interview, Costin digs into why he left the GReAT team after 13 years at the helm, ethical questions on exposing certain APT operations, changes in the nation-state mal
Jan 5, 2024 · 34 min
Danny Adamitis on an 'unkillable' router botnet used by Chinese .gov hackers
Episode sponsors: - Binarly, the supply chain security experts (https://binarly.io) - FwHunt (https://fwhunt.run) Danny Adamitis is a principal information security engineer at Black Lotus Labs, the threat research division within Lumen Technologies. On this episode of the show, we discuss his team's recent discovery of an impossible-to-kill botnet packed with end-of-life SOHO routers serving as a covert data transfer network for Volt Typhoon, a Chinese government-backed hacking group previou
Dec 21, 2023 · 38 min
Allison Miller talks about CISO life, protecting identities at scale
Episode sponsors: - Binarly, the supply chain security experts (https://binarly.io) - FwHunt (https://fwhunt.run) Allison Miller is founder and CEO of Cartomancy Labs and former CISO and VP of Trust at Reddit. She has spent the past 20 years scaling teams and technology at Bank of America, Google, Electronic Arts, PayPal/eBay, and Visa International. In this conversation, we discuss the convergence of security with fraud prevention and anti-abuse, the challenges and complexities in IAM impl
Dec 7, 2023 · 51 min
Rob Ragan on the excitement of AI solving security problems
Episode sponsors: - Binarly, the firmware security experts (https://binarly.io) - FwHunt (https://fwhunt.run) Rob Ragan, principal architect and security strategist at Bishop Fox, joins the show to share insights on scaling pen testing, the emergence of bug bounty programs, the value of attack surface management, and the role of AI in cybersecurity. We dig into the importance of proactive defense, the challenges of consolidating security tools, and the potential of AI in augmenting human inte
Nov 21, 2023 · 28 min
Seth Spergel on venture capital bets in cybersecurity
Episode sponsors: - Binarly, the firmware security experts (https://binarly.io) - FwHunt (https://fwhunt.run) Seth Spergel is managing partner at Merlin Ventures, where he is responsible for identifying cutting-edge companies for Merlin to partner with and invest in. In this episode, Seth talks about helping startups target US federal markets, the current state of deal sizes and valuations, and the red-hot sectors in cybersecurity ripe for venture investment.
Nov 14, 2023 · 41 min
Dan Lorenc on fixing the 'crappy' CVE ecosystem
Episode sponsors: - Binarly, the firmware security experts (https://binarly.io) - FwHunt (https://fwhunt.run) Dan Lorenc is CEO and co-founder of Chainguard, a company that raised $116 million in less than two years to tackle open source supply chain security problems. In this episode, Dan joins Ryan to chat about the demands of building a "growth mode" startup, massive funding rounds and VC expectations, fixing the "crappy" CVE and CVSS ecosystems, managing expectations around SBOMs, and ho
Nov 7, 2023 · 31 min
Cisco Talos researcher Nick Biasini on chasing APTs, mercenary hackers
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) Nick Biasini has been working in information security for nearly two decades. In his current role as head of outreach for Cisco Talos Intelligence Group, he leads a team of threat researchers tasked with tracking nation-state APTs, mercenary hacker groups and ransomware cybercriminals. In this episode, Biasini talks about the cryptic world of threat actor attribution, the rise of PSOAs (private sector offensive act
Nov 1, 2023 · 48 min
Allison Nixon on disturbing elements in cybercriminal ecosystem
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) Allison Nixon is Chief Researcher at Unit 221B and a trailblazer in the world of cybercrime research. In this episode, we deep-drive into the shadowy dynamics of underground criminal communities, high-profile ransomware attacks, teenage hacking groups breaking into big companies, and the challenges of attribution and law enforcement. Allison sheds light on why companies continue to be vulnerable targets and what th
Sep 15, 2023 · 55 min
Dakota Cary on China's weaponization of software vulnerabilities
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) Dakota Cary is a nonresident fellow at the Atlantic Council’s Global China Hub, conducting research on China’s efforts to develop its hacking capabilities, artificial-intelligence and cybersecurity research at Chinese universities, the People’s Liberation Army’s efforts to automate software vulnerability discovery, and new policies to improve China’s cybersecurity-talent pipeline. In this episode, Cary expands on
Sep 12, 2023 · 33 min
Abhishek Arya on Google's AI cybersecurity experiments
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) Abhishek Arya is director of engineering at Google, overseeing open source and supply chain security efforts that include OSS-Fuzz, SLSA, GUAC and OSV DB. In this episode, Arya talks about some early success experimenting with AI and LLMs on fuzzing and vulnerability management, the industry's over-pivoting on SBOMs, regulations and liability for software vendors, and the long road ahead for securing software su
Aug 31, 2023 · 40 min
Dr Sergey Bratus on the 'citizen science' of hacking
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) Dr Sergey Bratus is a Research Associate Professor of Computer Science at Dartmouth College and a program manager at DARPA. In this episode, he discusses his pioneering work on securing parsers and patching long-forgotten devices. He also puts the AI hype into context and showers praise on the labor-of-love "citizen science" of hacking all the things.
Aug 20, 2023 · 26 min
DARPA's Perri Adams on CTF hacking, new $20M AI Cyber Challenge
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) DARPA program manager Perri Adams joins the conversation to chat about her love for CTF hacking competitions, the hunt for leapfrog security technologies in DARPA’s Information Innovation Office (I2O), and the goal of the new AI Cyber Challenge (AIxCC) offering $20 million in prizes to teams competing to develop AI-driven systems to automatically secure critical code.
Aug 16, 2023 · 42 min
Ryan Hurst on tech innovation and unsolved problems in security
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) Peculiar Ventures chief executive Ryan Hurst joins the show to talk about a career that spanned 20 years at Microsoft and Google, his work building the plumbing for encryption on the web, unsolved problems in BGP security, the hype and promise of AI, and Microsoft's ongoing cloud security hiccups.
Aug 7, 2023 · 27 min
Jason Chan on Microsoft's security problems, layoffs and startups
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) Bessemer Venture Partner's Jason Chan returns to the show for a frank discussion on the state of cyber, including thoughts on Microsoft's prominent security failures, the meaning of layoffs hitting security teams, the excitement around AI, and the long road ahead. The former Netflix security chief also talks about merging of the IT and security functions and the importance of cybersecurity proving its value to the
Aug 2, 2023 · 40 min
GitHub security chief Mike Hanley on secure coding, AI and SBOMs
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) GitHub security chief Mike Hanley joins the show to discuss merging the CSO and SVP/Engineering roles, securing data and code in an organization under constant attack, the thrilling promise of AI to the future of secure code, the dangers of equating SBOMs to supply chain security, and new SEC reporting rules for CISOs.
Jul 26, 2023 · 33 min
Jason Shockey, Chief Information Security Officer, Cenlar FSB
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) Cenlar FSB security chief Jason Shockey joins the show to discuss the task of securing a financial institution, pivoting from a career in the military to the private sector, the current state of the job market, managing risk from APTs, and the mission of his My Cyberpath project.
Jul 19, 2023 · 42 min
Federico Kirschbaum on a life in the Argentina hacking scene
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) Faraday chief executive Federico 'Fede' Kirschbaum joins the show to talk about building a startup in the vulnerability management space, the intricacies of the Argentinian hacking culture, stories of exploit writers and mercenary hackers, and the overwhelming U.S.-centric view of the cybersecurity industry.
Jul 12, 2023 · 48 min
Kymberlee Price reflects on life at the MSRC, hacker/vendor engagement, bug bounties
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) Product security executive Kymberlee Price joins the show to gab about life in the trenches at the Microsoft Security Response Center (MSRC), the challenges of maintaining healthy hacker/vendor relationships, the harsh realities of bug-bounty programs, and thoughts on the cybersecurity job market.
Jul 5, 2023 · 36 min
OpenSSF GM Omkhar Arasaratnam on open-source software security
Episode sponsors: - Binarly (https://binarly.io) - FwHunt (https://fwhunt.run) New General Manager of the Open Source Security Foundation (OpenSSF) Omkhar Arasaratnam joins the podcast for a candid conversation on the challenges surrounding open-source software security, lessons from the Log4j crisis, the value of SBOMs, and the U.S. government efforts at securing America's software supply chains.