Security Weekly Podcast Network

The episode contains genuinely substantive segments - particularly the cloud IAM inversion logic and the Fortibleed technical breakdown - but large stretches are consumed by banter, off-topic tangents (Gaelic company names, college orientations, bathroom habits), and the fundamentals discussion meanders without resolution. Useful ideas per minute is modest.

“we inverted the logic to basically restrict the privileged permissions at the global level. So everybody was denied...But we use the history to then make exceptions in those global policies for the things that needed them”

“Half of all of the identities sitting there are unused in that”

The historical-activity-based default-deny approach for cloud IAM is a genuinely fresh framing, and using SCP/RCP global policies as an enforcement layer rather than per-resource remediation is a non-obvious inversion. Everything else - fundamentals discussion, GPU cracking concerns, domain takeover warnings - is familiar security podcast territory recycled without much new angle.

“if something has never...created a pre signed URL before...it's never done that before. That is maybe intentional...it's also a really high fidelity signal to the soc”

“organizations are constantly worrying about generative AI threats. But this incident has tens of thousands of organizations without even multi factor authentication”

Sandy Bird has legitimate practitioner credentials as co-founder of Q1 Labs (acquired by IBM) and five-year CTO of IBM Security, and he speaks from real product-building experience rather than thought-leadership abstraction. The segment is partially a promotional pitch, which dilutes the caliber signal somewhat.

“I was one of the founders of a company called Q1 Labs many, many years ago...we ended up selling that to IBM. And when I moved over to IBM after the acquisition, I was the CTO of their security division for five years”

“Datadog and us are probably the only two that do access to their cloud via third party without using secrets”

The Fortibleed section is data-rich with named version numbers, specific hashing algorithms, attacker infrastructure metrics, and credential volumes that give it genuine evidential weight. The cloud IAM segment has a credible 92% over-privileged stat and a concrete quarantine mechanism description, though some claims (e.g. company comparisons) go unsupported.

“74,000 Fortinet devices in 21,000 domains in 194 countries”

“2.1 billion credentials they were trying against Ms. SQL...1.6 billion credentials they were trying against Fortigate targets. 320,000 attempted targets”

There are genuine technical follow-ups - Larry pressing on whether proxy SDK functions are actually reachable versus merely present, Lee proposing an early-wake anomaly detection idea, Jeff raising the quantum-hashing question - but the Sandy Bird segment is a sponsored softball with no meaningful challenge, and substantial airtime is lost to off-topic banter and circular fundamentals debate with no sharp resolution.

“my question is one, is this really a threat? Like, uh, are the components for the proxy stuff actually reachable by any of the software in use or is it just present in the apps”

“let's say we got this thing that wakes up over every 363 days. If you model that in such that if it wakes up after 200 days, you're saying whiskey Tango, Foxtrot”