Security Confidential S13 E0 Chris Cazel

Chris Cazel: This is what I—Like, that’s what I got right now, yeah. Maybe you don’t, maybe you don’t grow to hate a sound like this because I feel like nature—this sound occurs naturally. That’s called Hideout Row. And I used to have, I said, and this is called Caribbean Cove. Can I hear “Nuclear Meltdown” now? Yeah. Welcome everybody to Dark Rhiino Security Confidential Happy Hour.

Chris Cazel: I’m Chris Cazel. We got Rory Meikle here. Just a little fun episode this week. Not much happening in the news. We’ll touch on it a little bit, but mostly just Rory and I doing what we do whenever we sit down next to each other. So, here we go. Get ready.

Chris Cazel: Okta had a pretty big breach six months ago. Do you remember that one? This was the one where somebody in the Okta support desk—their account was compromised and they had access to clients.

Rory Meikle: Yeah.

Chris Cazel: That’s old news, but that was social engineering that got them in. For this one, I think it only affected four or five clients. Yeah, but somebody—I don’t know if they got a list of names or what it is. I’ll have to find the article because the client actually showed it to me and he was like, “What protections do we have in place?” But there’s the same kind of thing. People who are super administrators in their directory—this whole Okta thing had no—it wasn’t a breach like an exploit or a vulnerability in their product. It was the same thing: somebody got phished or social engineered into going in as a super admin and unblocking or creating an account for people or whatever it was. So yeah, it’s the same kind of thing where it wasn’t actually a vulnerability in the code; it was just all the human element. And I was like, there’s not really anything you can do about that. Yeah. That’s just poor—I don’t know—hygiene.

Rory Meikle: Yeah, because they’ll have MFA or user maintenance. Yeah, they all have—you can train your company about social engineering and phishing and stuff, but at the end of the day, if they go in and they keep clicking “approve” on the MFA prompt and typing in the code while somebody’s talking them through it, there’s nothing you can do. Yeah, if they’re supposed to have access. So they’re asking me what they can do and I said, “There’s not really that much you can do.” You just have to educate them. Yeah. And other things, like force your admins to sign in from the VPN or the corporate network or something. But still, if they want to get in, they can. You can’t really stop them. It’s just kind of sad.

Chris Cazel: It’s true. Yeah, it is true, but at least it wasn’t a vulnerability with Okta.

Rory Meikle: Yeah, it’s always no good when it’s a technical problem, you know? It’s almost pleasing to hear when it’s a social engineering thing because then at least you know, okay, well the technology works, right? It’s just an ignorant user. There’s not much you can do about that. I wonder if they keep their job after that kind of thing. I know for a fact there are companies who, if you fail a phishing test an X amount of times, they let you go because you’re a security risk.

Chris Cazel: Well, I mean, if it’s happening multiple times, yeah. I think it’s reasonable. I don’t know the number—three times or five times—but too many times… Dude, me, I would be like… We do the phishing software for people. For one of our clients, it’s like 50 users, maybe. On the first one, one person got lured, failed, and the CEO made an announcement about it and posted the metrics around the test to the company for everybody to see. It’s been perfect since then. Nobody wants to be that guy. Yeah. Well, you know, I think… man, I never really look at an email for more than three seconds if it’s something that I’m not expecting to see, right? So if I email somebody and I’m waiting for that person to email me back, I’m expecting a reply. Then that’s an email I’ll pay attention to. But any email that comes up in my inbox that’s just there and I didn’t solicit it, you know, like actively solicited… Obviously, there are things that come daily that you subscribe to or what have you, right? But I don’t pay very close attention to those. You know, some of these people who get into trouble with phishing emails, you’d think every email that you get is massively important to you. I mean, maybe there are jobs where it is, you know, but at the same time…

Rory Meikle: Yeah, I know. I think it depends because like, if it looks to me like spam—because you know how in Outlook you see the left-hand pane and it’s like the beginning of the subject you see—if it looks like spam, I just click it to mark it as read and keep going. I don’t even look at the contents. But a lot of the ones I see that people actually do open are any kind of impersonation. Like, if it’s your CEO’s name at a weird domain, they’ll still open that and read it for sure.

Chris Cazel: Yeah, I can see that. So it’s hard to say. Well, you know what data I have is that… On my phone, I have it set so that anytime Kevin or manage email me, it dings. And what I’ve noticed is that I get sometimes impersonation emails from Kevin, but more so what I do get is like Zoho spam that comes from “Kevin Casey,” but they don’t ding my phone.

Rory Meikle: When it’s from Kevin, is that a specific address?

Chris Cazel: That specific address, yeah.

Rory Meikle: That’s smart. All right. See, I have it do that with certain clients, and then if somebody mentions Okta in the email, then it dings.

Chris Cazel: Yeah, yeah, same kind of thing, right? But if somebody knew that, they would email me about Okta.

Rory Meikle: Well, now they might. We gotta beep that out.

Chris Cazel: Yeah. That’s too funny. Yeah, no, I don’t know. Yeah, I mean, security at the end of the day, dude, it’s always going to be user error 99% of the time. Think about how much harder it is to find a vulnerability and then exploit that vulnerability and then be able to do something with that—exfiltrating information off that vulnerability. Yeah, think about how easy it is to manipulate one. You know what I mean? Like, come on. Yeah, there’s some foolish people out there. You know, like I was telling you about that breach in this little system back in Wisconsin. I promise you, dude, it was 100% user error slash just some kind of general carelessness.

Rory Meikle: Yeah, but social engineering—that’s what I’m looking for. Yeah, you know, I promise you it wasn’t like their email scanning went down for 766 hours or something like that. You know what I mean? The hospitals are usually pretty tight with that kind of stuff. Yeah, but I have seen a lot of accepted risk kind of stuff, like a really old application or an old database or something that’s still used to this day, that’s been there for 20 years, that’s not updated or anything. And they can’t update it; they just write off the risk. Like, “We know that this system is unpatched and there’s nothing we can do about it.” And that kind of stuff is when social engineering is relevant. You can just exploit that stuff. Yeah.

Chris Cazel: I’m going to finish the ice bag while we’re here.

Rory Meikle: Yeah, no, you got them, bro. Can I have a cube?

Chris Cazel: Yeah, you want my glass? Sharing is caring at Dark Rhino Security. Yeah, for those of you who don’t know, which is probably all of you who are watching this: we had amassed an exquisite collection of bourbon, whiskey, and scotch. There’s some rum in there—there’s some rum in there and some brandy as well—but it’s, yeah, three, three… It’s like six shelves plus the top, and the cabinet’s probably this wide. It’s pretty cool, actually. It’s deep, maybe. It’s a good collection. What’s Hennessy considered again?

Rory Meikle: Cognac. There’s some cognac there, too.

Chris Cazel: Yeah, there is, huh? Yeah. Something for everybody except vodka.

Rory Meikle: Yeah, there’s no vodka in there. And you know what? You remember old Pavel with that vodka? I got the Jewel of Russia; I still haven’t tried it yet. But I was like, man, I don’t want to take it out of my freezer now and transport it here. True. Yeah, once it’s in the freezer, it’s staying in the freezer. Yeah, so you can’t really put it on display, too.

Chris Cazel: No, no, you can’t. Now, that’s the thing. But I do like that my whiskey cabinet at home is almost full, yeah. And I don’t have much space, but it’s lucky. Mine’s empty. Yeah, no more Fernet, yeah.

I was thinking about this thing because Counter-Strike 2 is coming out. Do you ever play Counter-Strike?

Rory Meikle: No, no.

Chris Cazel: It’s not an old game, but CS:GO right now…

Rory Meikle: Was that Counter-Strike: GO?

Chris Cazel: Yeah, Global Offensive. Counter-Strike: Global Offensive. Okay. It was the last iteration; the new one just came out. But I was reading and there’s all this controversy because when you buy a game on Steam—for those on Steam—yeah, yeah, when you buy a game on Steam, it’s not like the old days where you go to Target or whatever and buy a PlayStation game and have the disc. You’re essentially leasing it from Steam.

Rory Meikle: Really?

Chris Cazel: Yeah. So you don’t actually own a physical copy of it.

Rory Meikle: That has to be troublesome.

Chris Cazel: It is weird, right? Because with digital copies, if you go on the PlayStation Store and buy a game, you own that copy, right? Or whatever. I don’t know. Like if you buy the downloadable content on the PlayStation Network or Xbox… whatever it is, I don’t think you—I think it’s the same thing, I’m guessing.

Rory Meikle: Yeah.

Chris Cazel: But with Steam, it’s in the agreements now that your right to play can be revoked on a whim, essentially.

Rory Meikle: That’s probably… I’m sure if they find out… I’ll just say, a controversial figure… either way, you can be denied from playing cards, probably. I think schools should teach you how loans work, for one thing, and how credit works. Because a lot of the time, people get a credit card and have no idea what the hell is happening behind it. “What if I don’t pay it this month?” Most people don’t care when they get their first credit card. That would be a good skill. Yeah. Could have saved me a bit of trouble back when.

Chris Cazel: I think that’s everyone, man. I mean, credit cards are like… you know what the worst thing about a credit card is? It’s that you have no real way to comprehend how much you’re actually spending. I mean, you just swipe it.

Rory Meikle: Yeah. You know, versus, dude, you use cash. You want to see how much money you actually spend? Walk around with cash, man. Like when I go on vacation, I try to take cash with me instead. And the last place we went, I think I took 400 bucks. It was like a weekend thing. By Sunday, dude, I was down to 20 bucks.

Chris Cazel: Yeah, yeah. That’s a good point. You don’t really think about it when it’s just numbers out there.

Rory Meikle: Yeah. But when you’ve got cash, you just…

Chris Cazel: I agree with you. This is what I was thinking about with the Steam thing, because, like, speaking of credit, you don’t actually own these games that you buy, right? Everybody buys on credit. Most adults are in debt. Most people rent. There are fewer people of our generation who own homes and whatnot. Most people don’t have assets, or they’re renting or leasing a car. Someday, we’re going to literally own nothing except food, which you consume on the spot.

Rory Meikle: And it’ll be bugs. Don’t forget that.

Chris Cazel: But I can see somewhere down the line, nobody owns anything. That’s the whole goal, dude. You’ll own nothing and like it. Everybody streams now; nobody buys a DVD. You know, that’s a true shame, man. And I was telling—I mean, I’m staying on counsel, but she’s basically the only one I talk to, right? That’s right. But I want to have a nice home theater system, you know? But I want shelves of DVDs. I don’t want to have to… the classic, you know what I mean? Yeah. Because then you own that. I think about that all the time with streaming services and stuff. Like, if they just turn off the power, you don’t have it. You don’t own anything anymore.

Rory Meikle: Yeah, exactly. Even with Spotify, people don’t really buy albums anymore.

Chris Cazel: Yeah, right. People pay a subscription to Apple Music and whatever, but you don’t own any of that. Yes, I know. It’s crazy. Someday, everything is slowly getting rolled over into that model. Our businesses, too: software as a service.

Rory Meikle: Yeah. You don’t own the licenses.

Chris Cazel: Yeah, like Symantec on a disk anymore, like it used to be. If you stop paying your licensing fee, you don’t have protection. Yeah, that’s how they want it, man. It’s crazy. And everything is slowly getting rolled over into that price model or strategy. I don’t know what it is. I wonder if people actually make more money doing it that way.

Rory Meikle: Yeah, I don’t think it’s the money, man; I think it’s the control. I think you have so much more control when you can pull something from someone like that, you know? Versus if I buy something from you, it’s mine now. As long as I have physical possession of it, I own it. So I really don’t care as long as the value of whatever it is that I bought from you that I now own outweighs the repercussion of not doing whatever you want me to do. But if you can take it from me, you hold a lot more power.

Chris Cazel: Yeah, yeah. But do you think, in this day and age, if you’ve sold a hundred DVDs, you’d make more money in the short term than you do with a subscription to a streaming service? You know what I mean?

Rory Meikle: No, I don’t think so anymore. I’ll put it like this: I think right now, if you went out on the street, you would get more money selling somebody a subscription for a streaming service for six months than selling someone 100 DVDs.

Chris Cazel: I’d be curious to see because I don’t—I guess my point is I don’t think it’s all motivated by capitalism. I feel like you can make more selling physical media in the moment. I guess the six-month commitment might pay off in the long run, but generally, when you sell a bunch of DVDs, people use that to go and make their next movie immediately.

Rory Meikle: Yeah, maybe it’s more stable to operate. So I think, retrospectively, yes, but in the present day and age, no. It’s probably more stable. You can kind of plan out better how much you’ll make month to month rather than being a slave to how much your last movie made or something.

Chris Cazel: I just think right now the perceived value is around streaming and it’s around that instant ability, right?

Rory Meikle: Yeah, the convenience, right. And I think there’s nothing that jeopardizes the status quo, and while that maintains, people aren’t going to buy DVDs. People don’t care because it’s like, “I don’t need that; the internet works just fine. I can log in.” You know?

Chris Cazel: Yeah, this is something, too, that I was talking about today with—you know. I’ll just, yeah, I don’t know we could say it differently there, but… All those writers and actors are on strike, right? And no new stuff is being produced—well, some selective stuff is, I guess, but the majority of it is not. Dude, there are so many movies, media, and shows on all the streaming platforms, it doesn’t even matter. I was like, “I could probably watch something non-stop for years,” and I still wouldn’t have watched a quarter of what’s even on just one streaming application. Yeah, now you have two, three, four. I mean, you’ve got content for days. There’s a lot of garbage, but… yeah.

Rory Meikle: There’s a lot of garbage with anything. But do you have Disney Plus?

Chris Cazel: Yeah.

Rory Meikle: Do you watch Andor, the Star Wars one?

Chris Cazel: I don’t like Star Wars.

Rory Meikle: This one I actually liked. I’m not a Star Wars fan; I never got into Star Wars, so I don’t feel if I started anything related to that, I would get it.

Chris Cazel: Not even the original three films?

Rory Meikle: I’ve watched them.

Chris Cazel: Oh dude, they’re classics. The new ones aren’t good, but the original three were classics.

Rory Meikle: I didn’t like them. Who am I to say if they’re good or bad? I don’t know. I just can’t—I’m not a big sci-fi guy.

Chris Cazel: Yeah. I do like Predator, though. I like that.

Rory Meikle: Pretty different from Star Wars to Predator.

Chris Cazel: Yeah, yeah, those are cool. Do you want to see an alien?

Rory Meikle: Oh, I got a bunch of Alien. Like a newer one or the classic?

Chris Cazel: It was the first one.

Rory Meikle: Yeah, I’ve seen that one.

Chris Cazel: Alien with… the Ridley Scott film?

Rory Meikle: Yeah, yeah.

Chris Cazel: Okay. And then the second one where they’re shooting them on the…

Rory Meikle: Yeah, yeah. My dad used to watch those, so I watched them.

Chris Cazel: Yeah, that’s good. You know my favorite—to me is the standard of a movie, bro? James Bond movies. I remember being a little kid and watching GoldenEye. To me, that was like a mind-opening experience. You like Pierce Brosnan as James Bond?

Rory Meikle: I do like him, but I like Craig. I like Daniel Craig.

Chris Cazel: Yeah. I think he has way more class, I’ll say.

Rory Meikle: Yeah, a little bit, a little bit. You know, I don’t know, he’s just… he’s the perfect—opinion.

Chris Cazel: Yeah, those Pierce Brosnan ones were more action-packed, though. They actually set the stage for that early 2000s action movie. Like everything Vin Diesel ever did was because of what Pierce Brosnan did. That’s a good point. Triple X would not exist. Bro, Triple X, Fast and Furious, all of those 90-minute action-packed movies—they would not have happened if Pierce Brosnan didn’t do what he did in GoldenEye. All the ones: Tomorrow Never Dies—he made like four of them. Die Another Day. Yeah, there’s, I think there’s four of them. But his Double O movies were the most… they set the standard for what an action movie was supposed to be.

Rory Meikle: Yeah, and everything that came after that was like, “Okay, this is where we’re at now.” Look at the explosions, car chases, gunfights. Even nowadays, the Daniel Craig ones feel maybe a little more realistic.

Chris Cazel: Oh yeah, a lot of movies follow those, but I think that’s just because action, stunts, and CGI got so much better. Pierce Brosnan was like jumping from helicopter to helicopter and doing crazy stuff like that.

Rory Meikle: Yeah, I feel like Daniel Craig’s a little more mellow.

Chris Cazel: Yeah, his were definitely more realistic, and I think his were way more—they relied more on the story to draw you in, versus Pierce Brosnan’s—they were straight-up action movies.

Rory Meikle: Yeah, you know what I mean? You just went from scene to scene to scene of straight-up action. But Daniel Craig’s was like, “There’s an allure, there’s a story here, we’re working towards something bigger.” Ana de Armas is here.

Chris Cazel: Yeah, they sucker you in. Yeah, totally. And could you imagine not owning a DVD of GoldenEye? I want to own every 007 DVD.

Rory Meikle: Oh, that’d be cool as a collection.

Chris Cazel: Because I think personally, if those films ever got lost, media, like the movie industry as a whole, is whatever at that point. That’s true. Those movies were—I don’t know, maybe it’s not the same for everyone, but to me, those are like the pinnacle of movies that you go to the movie theater to see.

Rory Meikle: Yeah, because in my opinion, man, there are certain movies like when they come out, they just—they were never meant to be seen in theaters. Okay, they came out, cool, they’re in theaters, whatever, but there are certain movies that were specifically meant to be watched in theaters, and every Double O movie is one of those movies, 100%. I’ve probably seen the last ten in theaters. Yeah, like nobody missed going to see that. Like, Top Gun: Maverick, right? That also wasn’t released—like, Book Club: The Next Chapter. Not work. Movies like that, where you can just hang out on the couch and, you know, whatever. Throw up whatever you enjoyed then. Worst movie I’ve ever seen. I saw it for Mother’s Day; it was not my decision. Terrible. They got married—no plot. They just went to Italy. That was the whole movie.

I don’t know, nobody watches TV like that anymore, though. You know, it’s all like… I don’t know, that’s what’s weird about watching stuff on Disney Plus, Netflix. It all gets released at once, too, which is kind of weird.

Chris Cazel: Yeah, you know, I was actually talking about—about this. Changing things up, huh? Yeah, all right. What’s crazy to me is how… so we watched Sons of Anarchy. We watched the whole show maybe in a month, maybe six weeks. And, dude, I remember people were nuts about that show when it came out. But I was thinking, when this came out, they only released one season a year, ten episodes a year. So when that ten-episode period was up, dude, you had 42 weeks to go until you were able to fill the whole Jax and Sons of Anarchy crew. Yeah, right. So I mean, people just clamored. It’s like The Sopranos, dude. Like, you know, I got like… people lost their minds when The Sopranos ended how it ended. But that’s because they sunk how long into Sopranos? I think it’s six seasons, seven seasons. I don’t know; I’m watching all the way. So ideally, you know, you sunk seven years of your life into that. Think about that.

Rory Meikle: The last show I watched on television weekly was Game of Thrones, and I didn’t even watch the last couple seasons because I wasn’t that into it. But it’s the same kind of thing. During the off time, the anticipation just builds. That’s why it’s so cool.

Chris Cazel: That’s what I mean. And I think that’s an allure that is completely gone. That’s history now. Because if there’s a show that comes out now, and it’s on a streaming service, obviously I’m not going to watch it, you know, week to week to week to week. I’ll just wait until the whole thing comes out and then I’ll just binge-watch it. You just don’t get that anymore. You’re never going to be able to create that suspense and that anticipation for a series ever again, because people are going to be like, “I’ll just wait until it comes out so I can watch the whole thing.”

Rory Meikle: Yeah, you know what I mean? Also, they don’t do a great job of being like, “May 1st: new season of Sons of Anarchy.” It kind of appears one day, whereas on network TV, for three months there would be clips from the upcoming season playing.

Chris Cazel: Yeah, they don’t do a good job saying when stuff’s coming out or anything.

Rory Meikle: No, I do agree with that. They gotta find a better way to advertise upcoming stuff, but yeah. I just randomly check and see what’s new. I have no idea what to expect. Well, you know, I never watched TV shows or series prior to streaming services. All right, yeah. I never got into anything except for Family Guy. I watched Family Guy because that was hilarious.

Chris Cazel: Yeah, it was on every night.

Rory Meikle: Yeah, you’re gonna watch it. Yeah, I watched the Office, and I watched Game of Thrones.

Chris Cazel: Yeah, see, I watched the Office on Netflix when it first was on there streaming, and I watched the whole thing. I don’t know, I don’t remember watching that weekly, but that was like a cultural phenomenon. Everybody watched it.

Rory Meikle: See, that was before my time. I think I was in sixth grade when the Office was hot, just coming off the press, right? Yeah. I never watched it, but now even watching it and thinking back to where I was in that time, everything would have gone—yeah—stupid. I think at that time I was an eighth grader or freshman in high school. I just remember it being really popular at school. Everybody would watch it and then talk about it the next day. You’re at the water cooler, too.

Chris Cazel: Yeah. See, that’s lost on streaming services. Like, they all watch Euphoria and talk about that. They still do it. What’s Euphoria?

Rory Meikle: That’s just like a Zoomer show.

Chris Cazel: Oh, is it kind of like… I don’t know, never seen it.

Rory Meikle: I did watch that one, yeah. Ginny & Georgia—you ever seen that one?

Chris Cazel: No.

Rory Meikle: Probably… [Laughter] Oh, it’s like for current high schoolers, I guess. Yeah, so yeah. Well, that’s okay. Not worth it; that one’s not worth it. No, man, I don’t know. I can’t say I’ve watched anything really recently that I would recommend. It’s all mediocre at best, you know? Tom Brady directed “766 for Brady.” That surprised me.

Chris Cazel: He’s making movies now?

Rory Meikle: He’s gotta do something. He’s probably rich as heck.

Chris Cazel: Oh, he definitely is. He’s got that deal with Fox, I’m pretty sure. He’s probably loaded; he doesn’t have to keep doing stuff. You know, Sean Connery, once he hit the top, he walked away. He stopped making movies. He’s going to… he hasn’t done anything since. You know what I was going to say, though, is what I really actually do enjoy is that sometimes I stumble across these free movies on YouTube that are more documentary-esque. Give us an example. Okay, I watched one last week—no, it was like two weeks ago. It was an hour and six minutes long, but it was this documentary on Irish pubs in Ireland. They interviewed—they talked with like seven or eight different bar owners. Oh dude, it was, I don’t know, freaking fantastic. Educational, interesting, enjoyable. And you know what? My personal television experience… with streaming, I have to know what I want to watch. But with traditional TV, you just sit down and you just channel surf until you find something that is like, “Okay, I’ll watch it.” And then you just get sucked in, or you just watch it because it’s on next and you don’t want to get up and get the remote.

Rory Meikle: Yeah, it picks for you. There you go. I’m with you. Scroll forever now. Scroll forever. Scroll till you die. Yep. Or your soul leaves, whichever happens first.

Chris Cazel: [Laughter] You know, “scrolling forever”—this podcast could go on forever, so…

Rory Meikle: You’re right.

Chris Cazel: That’s the end. Thanks for the time, everybody.

Chris Cazel: talked with like seven or eight different bar owners oh dude it was I don’t know freaking fantastic educational interesting enjoyable and something you know what my personal television man streaming I have to know what I want to watch but traditional TV you just sit down and you just Channel surf until you found something that was like okay I’ll watch it and then you just got sunk it or you just watch it because it’s on next and you don’t want to get up and get the remote

Rory Meikle: yeah I mean the picks for you there you go I’m with you scroll forever now scroll forever scroll till you die yep or your soul leaves whichever happens first

Chris Cazel: [Laughter] you know scrolling Forever This podcast came come on forever so

Rory Meikle: you’re right

Chris Cazel: that’s the end good thanks for the time everybody