x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

InfoSec Bites

Welcome to Hello InfoSec, your ultimate hub for all things cybersecurity! Dive into our thrilling podcast series, InfoSec Bites, where we unleash deep dives into Information Security, jaw-dropping Major Security Incidents, cutting-edge Cloud Information Security, crucial Privacy topics, revolutionary Artificial Intelligence, mind-bending Quantum Computing, and so much more! Get ready to geek out with expert insights and stay ahead of the curve—hit that like button, subscribe now, and turn on

technology

All Episodes

00:42:39

REST APIs and Webhooks: Architecture and Security...

InfoSec Bites ·

2025/10/18

The discussion in this podcast provides an expert-level analysis of two foundational architectural paradigms in digital communication: REST APIs and Webhooks, emphasizing that they are complementary, not competitive, technologies. It explains that REST APIs operate on a pull-based, stateless model ideal for on-demand data retrieval, while Webhooks use a push-based, event-driven mechanism for real-time notifications, thereby avoiding the inefficiency of continuous polling. A significant portion of

en

00:29:04

OAIC vs Australian Clinical Labs: Establishment of...

InfoSec Bites ·

2025/10/18

The dicussion in this podcast details the landmark legal proceedings and outcome against Australian Clinical Labs (ACL) concerning a February 2022 data breach involving its acquired subsidiary, Medlab Pathology. The Australian Federal Court ordered ACL to pay $5.8 million in civil penalties for multiple breaches of the Privacy Act 1988 (Cth), marking the first such penalty under the Act. Specifically, ACL was found to have failed to take reasonable steps to protect personal information (affecting

en

00:38:30

The AI Crawler Bots Arms Race: Threat Report

InfoSec Bites ·

2025/10/17

The dicussion in this podcast provides an extensive threat report from 2025 detailing the "AI Crawler Arms Race," which is driven by the urgent need for vast, quality data to train Large Language Models (LLMs). The report explains that traditional bots are being rapidly replaced by highly adaptive, AI-driven crawlers, including Deep Reinforcement Learning (DRL) bots and Autonomous AI Agents, which effortlessly bypass static defenses like simple rate limiting or robots.txt files. This has

en

00:35:19

NIST PQC: The Race for Post-Quantum Standards

InfoSec Bites ·

2025/10/16

The discussion in this podcast provides an extensive overview of the National Institute of Standards and Technology (NIST) Post-Quantum Cryptography (PQC) standardisation process, which was initiated to combat the existential threat posed by future quantum computers to current public-key algorithms like RSA and ECC. NIST’s multi-year effort, which began in 2016, culminated in the selection of a diverse portfolio of quantum-resistant algorithms—including the lattice-based ML-KEM and ML-DSA, the

en

00:47:49

Active Directory, EntraID, Azure AD: MS Identity...

InfoSec Bites ·

2025/10/15

The podcat discussion provides a comprehensive security audit of Microsoft's identity services, comparing the architecture, protocols, and vulnerabilities of three distinct platforms: Active Directory Domain Services (AD DS), the legacy on-premises solution; Active Directory Federation Services (ADFS), the traditional federation server; and Entra ID (formerly Azure AD), the cloud-native identity platform. The text details the logical and physical structures of AD DS, focusing on Kerberos and

en

00:31:18

OpenSSL: Architecture, Agility, and Quantum Resilience

InfoSec Bites ·

2025/10/14

The discussion in this podcast provides an extensive audit of the OpenSSL 3.x toolkit, focusing on its architecture, strategic agility, and quantum resilience. It highlights that the shift to the modular Provider concept in OpenSSL 3.x is a critical evolution enabling cryptographic agility, particularly for the transition to Post-Quantum Cryptography (PQC) using hybrid key exchange schemes in TLS 1.3. The analysis identifies that historical failures, such as Heartbleed, stem primarily from low-level

en

01:06:47

AWS Security: An Exhaustive Analysis of its Defense...

InfoSec Bites ·

2025/10/13

The podcast discusses an extensive analysis of the Amazon Web Services (AWS) security architecture, focusing on its implementation of the Defense in Depth (DiD) strategy through a multi-layered framework. It establishes the Shared Responsibility Model as the foundational security principle, clearly separating AWS's responsibility for the "Security of the Cloud" from the customer's accountability for the "Security in the Cloud." The analysis systematically breaks down the

en

00:39:27

HTTP/2 Deep Dive: Architecture, Security,...

InfoSec Bites ·

2025/10/12

The discussion in this podcast provides an extensive analysis of the HTTP/2 protocol, detailing its architectural shift from the text-based HTTP/1.1 to a more efficient binary and stateful framework using features like multiplexing and HPACK header compression. It thoroughly explains how these performance-enhancing changes, which solve application-layer Head-of-Line (HOL) blocking, simultaneously introduce new security vulnerabilities centred on computational amplification and resource exhaustion

en

00:39:34

ISO 27001: Strategic Information Security Framework

InfoSec Bites ·

2025/10/11

The discussion in this podcast provides an extensive overview of the ISO/IEC 27001:2022 standard, which serves as the international framework for an Information Security Management System (ISMS). It explains that the standard is a strategic, risk-driven approach built upon the core principles of Confidentiality, Integrity, and Availability (CIA), rather than a mere technical checklist. It details the operational mechanism of the ISMS, which is mandatorily structured around the Plan-Do-Check-Act

en

00:44:44

AWS ELB, Route 53, and CloudFront Deep Dive

InfoSec Bites ·

2025/10/10

This podcast provides a comprehensive architectural and security analysis of three core AWS global delivery services: Elastic Load Balancing (ELB), Amazon Route 53 (DNS), and Amazon CloudFront (CDN). It explains the foundational mechanics of each service, detailing how ELB leverages the Hyperplane for scaling, how Route 53 uses an Anycast data plane for global resilience, and how CloudFront relies on a multi-tiered Edge and Regional Cache hierarchy for performance. A significant portion of the

en

00:27:38

SolarWind's Supply Chain Espionage: How Sunburst...

InfoSec Bites ·

2025/10/09

The discussion in this podcast provides an extensive analysis of the SolarWinds cyber incident, detailing how the sophisticated, state-sponsored attack leveraged the software supply chain to compromise thousands of customers, including critical U.S. government agencies. The operation, formally attributed to Russia's Foreign Intelligence Service (SVR), involved a meticulous infiltration of SolarWinds’ build environment to inject the SUNBURST backdoor into legitimate software updates. This overview

en

00:49:16

Pillars of Cyber Risk : Vectors, Surface, Appetite,...

InfoSec Bites ·

2025/10/06

The podcast provides a comprehensive discussion on the Governance, Risk, and Compliance (GRC) Nexus, specifically exploring four foundational cybersecurity concepts. It first defines the threat landscape from an attacker’s perspective, distinguishing between an Attack Vector, which is the specific method of exploitation (e.g., phishing), and the Attack Surface, which is the totality of an organization's exposure (e.g., all systems and employees). The second half of the discussion addresses the

en

00:55:05

CISSP Domain-8: Software Development Security

InfoSec Bites ·

2025/10/05

The dicussion in this podcast offers a comprehensive overview of Software Development Security, covering the Software Development Life Cycle (SDLC) and various Development Methodologies. The text systematically explains the phases of the SDLC—including requirements gathering, design, development, testing, and operations and maintenance—while stressing the importance of integrating security at every stage. Furthermore, the discussion contrasts traditional methods like Waterfall with iterative

en

00:26:35

Capital One Cloud Breach: Misconfigured WAF and Least...

InfoSec Bites ·

2025/10/04

The podcast discusses post-mortem analysis of the 2019 Capital One cloud breach, detailing the technical, human, and systemic failures that allowed for the compromise of approximately 106 million individuals' data. It explains that the attack was successful due to a misconfigured Web Application Firewall (WAF) and the violation of the Principle of Least Privilege, which allowed an attacker to steal highly privileged AWS credentials. Furthermore, the analysis emphasizes that the breach was a

en

00:37:12

JFrog Artifactory: DevSecOps, Binary Repository...

InfoSec Bites ·

2025/10/02

The discussion in this podcast provides a comprehensive security overview of JFrog Artifactory, a critical and foundational component acting as a universal binary repository manager within the software supply chain. It explains Artifactory's core architecture, including its server, database, and various repository types (local, remote, virtual), and emphasizes its indispensable role in DevOps and CI/CD pipelines. It highlights that the platform faces significant threats stemming from

en

00:51:58

CISSP Domain-7: Security Operations

InfoSec Bites ·

2025/10/01

The podcast discussions details critical aspects of maintaining an organisation's security posture and operational resilience. The discussion covers security operational controls such as auditing and logging, enforcing least privilege and separation of duties, and implementing change management and configuration management practices to maintain system integrity. A significant portion addresses physical security measures, including defensive perimeters, access controls like locks and surveillance

en

00:48:37

CISSP Domain-6: Security Assessment and Testing

InfoSec Bites ·

2025/09/30

This discussion in the podcast provides an extensive overview of security assessments, testing, and audits, detailing the processes necessary to evaluate an organization's security posture. It explains the differences between vulnerability testing, penetration testing, and formal audits, including various testing methodologies like black box, white box, and gray box approaches. Furthermore, it discusses the importance of security metrics and indicators (such as KPIs and KRIs) for measuring the

en

00:56:21

Australian Privacy Principles: Deep Dive for InfoSec...

InfoSec Bites ·

2025/09/29

The podcast dicussion provides an extensive analysis of the Australian Privacy Principles (APPs), which constitute the core legal framework for data protection under Australia's Privacy Act 1988. It functions as a strategic guide for Information Security (InfoSec) professionals, breaking down the thirteen legally binding principles that govern how most government agencies and private organisations ("APP entities") must manage personal information throughout its lifecycle. Key concepts

en

00:51:37

CISSP Domain-5: Identity and Access Management (IAM)

InfoSec Bites ·

2025/09/28

The dicussion in this podcast provides an extensive overview of Identity and Access Management (IAM) concepts, focusing on the critical phases of identification, authentication, and authorization within secure systems. They detail various authentication methods, including passwords, multi-factor authentication (MFA), and biometrics, explaining the mechanics and weaknesses of each. A significant portion covers different access control models such as Discretionary (DAC), Mandatory (MAC), and

en

00:35:08

ISO 27005: A Strategic Deep Dive into Information...

InfoSec Bites ·

2025/09/27

The discussion in this podcast provides an extensive comparative analysis of two leading information security risk management methodologies: the ISO/IEC 27005 standard and the NIST Risk Management Framework (RMF). It establishes that modern organisations require a proactive, systematic approach to manage persistent cyber threats and details the philosophical differences, with ISO 27005 being a flexible, global standard for enterprise-wide Information Security Management Systems (ISMS), and NIST RMF

en

123 results

Similar Podcasts

Lead With AI

Tamara Nall

Linux in the Ham Shack

Black Sparrow Media

Data Engineering Podcast

Tobias Macey

Eye On A.I.

Craig S. Smith

Reflections

Livewire Labs