How to Perform Incident Response and Forensics on Drones with Wayne Burke

Summary:

In this episode of Exploring Information Security, host Timothy De Block sits down with Wayne Burke to discuss the crucial and rapidly evolving field of drone tactical forensics and incident response. Wayne sheds light on the increasing proliferation of drones, from law enforcement applications to criminal misuse, and the unique challenges involved in collecting forensic evidence from them. He reveals the dangers of booby-trapped drones and malware on flight controllers, emphasizing the need for caution and specialized techniques. Wayne also shares a fascinating incident involving electronic warfare against a surveillance drone, underscoring the sophisticated threats emerging today. Tune in to learn about essential forensic methods, from accessing flight logs with open-source tools to advanced chip-off forensics, and why collaboration in the cybersecurity community is vital for addressing these new challenges.

What You'll Learn:

  • What drone tactical forensics entails and its growing importance in today's world of automated robotics.

  • The diverse and increasing applications of drones, including surveillance and the potential for misuse like extortion.

  • Significant risks and dangers in drone forensics, such as booby traps and flight controller malware.

  • Initial steps and varied techniques for drone incident response and forensic evidence collection, depending on the drone type.

  • How flight logs and telemetry data are analyzed using open-source tools, and methods for advanced forensics like chip-off analysis.

  • The critical role of community and collaboration in addressing emerging drone security threats.

Use the promo code “ExploringSec” to get $50 off your registration

Showmecon Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


That Shouldn't Have Worked: A Red Teamer's Confessions with Corey Overstreet

Summary:

In this episode of Exploring Information Security, host Timothy De Block speaks with Corey Overstreet, a seasoned pentester from Red Siege. Corey shares insights into the ongoing cat-and-mouse game between red teams and blue teams, revealing common vulnerabilities and unexpected successes in breaching defenses. He discusses his upcoming talk at Show Me Con, titled "That Shouldn't Have Worked," which aims to equip blue teams with practical knowledge on bolstering their defenses against persistent attackers. From the nuances of payload delivery to the surprising resilience of old tricks and the challenges of cloud security, Corey offers a candid look at the daily realities of offensive security and how defenders can truly make a red teamer's life difficult.

What You'll Learn:

  • The core focus of Corey Overstreet's "That Shouldn't Have Worked" talk at Show Me Con.

  • Common mistakes red teamers make and how to avoid them.

  • Effective defensive strategies for blue teams, including the power of application control and network segmentation.

  • The evolving landscape of EDR and how AI is starting to make red team operations more challenging.

  • Insights into the surprising ways macros and social engineering continue to be effective entry points, especially in cloud environments.

  • Advice for aspiring pentesters on learning and problem-solving, emphasizing hands-on practice and diligent note-taking.

  • Corey's favorite resources for staying up-to-date in cybersecurity, including various subreddits, Discord, and Slack communities.

Use the promo code “ExploringSec” to get $50 off your registration

Showmecon Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


when machines take over the world with Jeff Man

Summary:

In this engaging episode of Exploring Information Security, host Timothy De Block sits down with cybersecurity expert Jeff Man. They dive into Jeff's recent experiences at the RSA Conference, his seasoned and sometimes "grumpy old man's perspective" on the pervasive topic of AI, and what he's looking forward to in upcoming speaking engagements. The conversation explores the ever-evolving landscape of cybersecurity, the challenges and hype surrounding new technologies, and the enduring principles of security that remain constant despite technological shifts.

What You'll Learn:

  • Key takeaways and observations from the RSA Conference, including attendance figures and vendor extravagances.

  • Jeff Man's unique perspective on Artificial Intelligence, separating hype from potential impact.

  • The recurring themes in cybersecurity, highlighting how fundamental problems persist across different technological eras.

  • Insights into the risks and limitations of AI, including its potential for misinformation and Jeff's personal skepticism.

  • A first-hand account of riding in a Waymo self-driving car and reflections on autonomous technology.

Use the promo code “ExploringSec” to get $50 off your registration

Showmecon Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


How to Disconnect From Cybersecurity

Summary:

In this heartfelt episode of Exploring Information Security, we sit down with Elizabeth Eggert-Guerrant to talk about the importance of disconnecting from the always-on world of cybersecurity. Elizabeth shares her personal journey, which began with a cruise to Antarctica and led to profound revelations about burnout, digital overload, and the power of being present.

Drawing from her experience in leadership and her passion for mental health, Elizabeth unpacks how the culture of constant connectivity in cybersecurity—and life in general—can affect our well-being. From sneaking work emails in the bathroom on vacation to re-learning the value of quiet moments and real human connection, this episode explores what it means to truly step away and reset.

Whether you're an industry veteran or just getting started, Elizabeth offers advice on setting boundaries, recognizing burnout in yourself and your team, and creating space for reflection in a high-pressure industry.

What You’ll Learn

  • Why disconnecting is critical for mental health in cybersecurity

  • How to identify burnout in yourself and others

  • The value of setting daily rituals and boundaries

  • The role of leadership in fostering mental well-being

  • The pressure of “doing more” on social media—and how to step back

Use the promo code “ExploringSec” to get $50 off your registration

Showmecon Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


How to Implement a Content Security Policy (CSP)

Summary:

In this episode of the Exploring Information Security podcast, host Timothy De Block sits down with Jason Gillam, long-time developer turned penetration tester and partner at Secure Ideas. The two dive into the real-world value of Content Security Policy (CSP) and why it remains one of the most underutilized tools in web application defense.

Jason shares insights from his upcoming talk at ShowMeCon 2025, including surprising statistics from his analysis of over 750,000 domains, where he found that most CSPs are either missing or misconfigured. He breaks down how CSP works, its role in protecting against injection attacks, and strategies for implementing it properly using nonces, hashes, and report-only modes.

They also discuss:

  • The challenges of educating developers on CSP

  • CSP vs. WAF and where each fits in the security stack

  • How AI and CI/CD can support secure CSP deployment

  • The importance of building security into code rather than bolting it on later

Whether you're a developer, security professional, or somewhere in between, this episode offers practical and actionable advice on improving your web application security posture.

Mentioned Resources:

Use the promo code “ExploringSec” to get $50 off your registration

Showmecon Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


how to monitor the inner workings of a cybercriminal organization

Summary:

What does it take to monitor the inner workings of ransomware gangs? In this episode, Matthew Maynard shares his firsthand experience infiltrating cybercriminal communities to gather valuable threat intelligence. From learning the lingo to navigating criminal hierarchies, Matthew sheds light on the surprising structure and behavior of ransomware operators. We discuss the importance of operational security, the surprising transparency of cybercriminal forums, and how researchers can play a critical role in disrupting ransomware infrastructure.

Topics Discussed:

  • How Matthew got started monitoring cybercriminal groups

  • The business model and hierarchy of ransomware gangs

  • Use of AI, insider threats, and criminal marketing tactics

  • Tools and platforms used by cybercriminals (Tor, Tox, Telegram, etc.)

  • Lessons learned from forums, breach leaks, and failed infiltration attempts

  • The value of open-source intelligence in tracking threat actors

  • Why reputation matters—both for threat actors and researchers

  • Operational safety tips for researchers entering dark web spaces

Guest Bio:

Matthew Maynard is a cybersecurity professional and threat researcher who specializes in tracking the behavior of ransomware gangs and cybercriminal forums. He shares his insights through articles on Hacker Noon and speaks regularly at conferences like ShowMeCon.

Links & Resources:

Use the promo code “ExploringSec” to get $50 off your registration

Showmecon Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


Gamifying Your Incident Response Playbook with Anushree Vaidya

Summary:

In this episode, Tim speaks with Anushree Vaidya about her upcoming presentation at ShowMeCon: Ransomware Rampage: Gamifying Your Incident Response Playbook. Anushree shares her passion for making cybersecurity training more interactive, emphasizing how gamifying the ransomware incident response process can transform traditional playbook exercises into dynamic, collaborative experiences.

Anushree explains how ransomware-specific playbooks differ from general incident response plans, the benefits of hands-on exercises for diverse teams, and how organizations of all sizes can adapt her training approach internally. She also discusses overlooked early indicators of ransomware attacks, communication challenges between technical teams and leadership, and how proactive preparation can significantly reduce the pain of an incident.

Topics Discussed

  • Why ransomware-specific playbooks matter

  • Turning incident response into a team-based, gamified learning experience

  • Building ransomware exercises that include IT, security, PR, HR, and leadership teams

  • Common gaps in ransomware detection and proactive preparation

  • Coaching technical teams on communication during incidents

  • Using AI to stay up to date with threat intelligence and reports

  • Tailoring incident response playbooks for different industries and organizational sizes

Key Takeaways

  • Participants will leave Anushree’s presentation with a customizable ransomware playbook and tools to take back to their organizations.

  • Gamified incident response exercises promote better communication, quicker learning, and stronger collaboration across teams.

  • Early detection and proactive measures like business impact analysis are critical to minimizing ransomware damage.

  • Communication planning—including legal, internal, and external messaging—is essential for effective response.

Connect with Anushree

  • LinkedIn: Anushree Vaidya

  • Women in CyberSecurity (WiCyS) Midwest Chapter Member

Anushree is passionate about connecting with others in cybersecurity, particularly in the Midwest region. Her DMs are always open for those who want to discuss ransomware, threat hunting, incident response, and cybersecurity strategy.

Use the promo code “ExploringSec” to get $50 off your registration

Showmecon Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


What is the Human Behavior Conference (HUBE)?

Summary:

Chris Hadnagy returns to the podcast to discuss the upcoming Human Behavior Conference (HUBE CON), a unique event blending psychology, neuroscience, and cybersecurity. Hosted in Orlando, FL, the 2025 conference focuses on the theme of "Influence and InfoSec"—with a diverse speaker lineup covering everything from nonverbal communication to neurodiversity in the cybersecurity field.

In this episode, Chris and Tim dive into how the conference is designed to foster deep learning and genuine human connection. They discuss how the sessions go beyond standard talks with hands-on trainings, interactive discussions, and practical takeaways for both cybersecurity professionals and those outside the industry. Chris also highlights how the conference has evolved over the years, the importance of accessibility for introverts, and what attendees can expect from this year's upgraded format.

Chris also shares updates on the Innocent Lives Foundation (ILF), a nonprofit focused on helping law enforcement identify and stop child predators, and touches on cutting-edge work at Social-Engineer, LLC—including new services involving deepfake social engineering simulations.

Discussion Points:

  • How the Human Behavior Conference bridges behavioral science and cybersecurity

  • Creating a conference you want to attend

  • Balancing science and practicality in session content

  • Building a community for introverts and extroverts alike

  • Why audience interaction creates stronger learning moments

  • The expanding role of AI in podcast production and social engineering

  • A preview of topics and speakers at this year’s HUBE CON

  • Updates from the Innocent Lives Foundation and Social-Engineer, LLC

Resources Mentioned:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


How Do Ransomware Gangs Work?

Summary:

In this episode of Exploring Information Security, we dive deep into the dark, complex world of ransomware gangs with returning guest Kyle Andrus. Drawing on leaked chat logs, real-world cases, and extensive incident response experience, Kyle helps us understand the internal operations, motivations, and evolution of these cybercriminal organizations.

We explore how ransomware gangs are structured like modern corporations—with developers, access brokers, negotiators, HR, and even customer support. Kyle also shares insights into how these gangs are adapting to legal pressure, sanctions, and the cybersecurity community’s defensive advancements.

Topics covered:

  • The organizational structure of ransomware gangs

  • Ransomware-as-a-Service (RaaS) models and profit sharing

  • Affiliate programs, access brokers, and laundering tactics

  • The impact of geopolitics on ransomware operations

  • Creative pressure tactics, including triple extortion and SEC complaints

  • The role of insider threats and chat log leaks (e.g., Conti)

  • Use of AI by defenders and attackers

  • The evolving response of law enforcement and regulation

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


Offensive Tools for Pentesters with Chris Traynor

Summary:

In this episode of Exploring Information Security, Tim chats with Chris Traynor of Black Hills Information Security (BHIS) and Ridgeback InfoSec. Chris is a seasoned penetration tester and educator who’s been developing hands-on training that’s grounded in real-world experience. He shares the origins of his “Offensive Tooling” classes, what makes a great pentest report, and how he balances teaching with travel, work, and family life.

Chris breaks down the tooling that matters, how he approaches infrastructure setup for operators, and why he emphasizes actionable reporting. He also talks about the importance of open-source tooling, customizing workflows, and automating the tedious parts of testing. Whether you're just getting into offensive security or are a veteran red teamer, this episode offers insights and practical takeaways.

Topics discussed:

  • The importance of hands-on offensive tooling training

  • How to write reports that are actually useful to dev and ops teams

  • Why pentesters need infrastructure knowledge

  • Open-source tools, custom scripts, and automation

  • The challenges and wins of presenting at BSides and beyond

  • Avoiding burnout while building community and sharing knowledge

Learn more about Chris’ upcoming training opportunities:

Social

Upcoming Events

 - Past ones...

ETHOS LAbs Links and Resources:

ETHOS LABS Website

Connect with Tim Folwer on Linkedin

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


Hands-On Hacking with James Gillkey

Summary:

In this episode of Exploring Information Security, host Tim De Block sits down with James Gillkey to discuss hands-on hacking training at ShowMeCon. James is revamping a long-standing pentesting training course to bring modern techniques, updated tools, and a focus on efficiency to security professionals. He shares insights into building effective training labs, leveraging Python virtual environments, and incorporating real-world offensive security methodologies into a structured learning experience.

Topics Discussed

  • The evolution of hands-on hacking training and its history

  • Setting up virtualized pentesting environments with Python and GitHub tools

  • Common mistakes in pentesting and how to avoid them

  • The balance between red team engagements and SOC awareness

  • The importance of password cracking, enumeration, and network recon

  • How cloud security assessments differ from traditional network pentesting

  • The role of AI in pentesting and whether it’s a useful tool or a shortcut

  • ShowMeCon’s Fallout-themed hacking lab and what to expect in the training

Key Takeaways

  • Hands-on experience is crucial. The best way to learn pentesting is by doing it.

  • Virtualized environments simplify tool management and prevent conflicts.

  • AI is an emerging tool in pentesting, but it doesn’t replace fundamental knowledge.

  • Cloud security requires a different mindset due to its unique challenges and toolsets.

  • Communication with SOC teams is essential to avoid unnecessary panic during testing.

  • Efficiency matters. The goal of the training is to give students actionable skills they can use immediately.

Further Resources

Use the promo code “ExploringSec” to get $50 off your registration

Showmecon Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


Breaking Bad Code with Kevin Johnson

Summary:

In this episode of Exploring Information Security, host Timothy De Block welcomes Kevin Johnson, founder of Secure Ideas, to discuss web application penetration testing, API security, and hands-on security training. Kevin shares insights on why pentesters need to understand business risk, how API security is often misunderstood, and what participants can expect from his Breaking Bad Code workshop at ShowMeCon. He also reflects on the state of security talks at conferences, the importance of interactive learning, and Secure Ideas’ 15-year journey in the industry.

Topics Discussed:

  • Web Application Security Challenges – Why automated tools alone aren’t enough, and how attackers think differently.

  • API Security & Misconceptions – How APIs change attack surfaces and why developers often overlook key security flaws.

  • Breaking Bad Code Training at ShowMeCon – What attendees will learn and why hands-on hacking beats passive lectures.

  • Security Talks vs. Vendor Pitches – The problem with sales-driven conference talks and why real education matters.

  • The Evolution of Secure Ideas – Celebrating 15 years in business, plus challenge coins and community growth.

  • Fun Side Tangents – Muppets, hacking culture, and why Wacka Hack is the talk you don’t want to miss at ShowMeCon.

Key Takeaways:

  • Effective pentesting goes beyond tools—it’s about understanding the purpose and risk of an application.

  • API security isn’t a separate discipline—it requires a shift in attacker mindset.

  • Hands-on training is the best way to learn—expect to actively hack at the Breaking Bad Code workshop.

  • Security conference talks should educate, not sell—vendor-heavy presentations fail to engage the audience.

  • ShowMeCon is an invaluable event for anyone interested in offensive security and application security.

Guest Info:

  • Kevin Johnson – Founder & CEO of Secure Ideas, security consultant, trainer, and conference speaker.

Links and Resources:

Use the promo code “ExploringSec” to get $50 off your registration

Showmecon Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


ShowMeCon and Security Perspectives with Amanda Berlin

Summary:

Use the promo code “ExploringSec” to get $50 off your registration

In this episode of Exploring Information Security, host Timothy De Block welcomes Amanda Berlin, CEO of Mental Health Hackers & Senior Product Manager at Blumira, to discuss her experiences in security product development, incident detection, and the challenges of balancing security with usability. They explore the limitations of pentest reports, the practicality of security automation, and the psychology behind effective security awareness training. Amanda also shares insights on how small businesses can implement security without breaking the bank and what to expect from ShowMeCon.

Topics Discussed:

  • Amanda’s Keynote at ShowMeCon – How she ended up speaking and why Dave’s method of picking speakers is unconventional.

  • Security Automation vs. Usability – Why some industries can implement auto-lockouts, while others (like hospitals) cannot.

  • The Problem with Pentest Reports – Why they often contain unrealistic security expectations that don’t translate to real-world environments.

  • Getting Buy-In for Security Solutions – How to understand what organizations actually need instead of pushing the latest security trend.

  • The Role of Nudge Theory in Awareness Training – Why small, repeated reinforcements can be more effective than long training videos.

  • Security for Small Businesses – Strategies for implementing security on a limited budget and making defenses practical.

  • Side Tangents & Fun Conversations – Crossword puzzles, Wordle streaks, and the absurdity of marketing budgets in cybersecurity.

Key Takeaways:

  • Security needs to be tailored to the environment—automation can improve security, but in some cases, it can create more risks.

  • Pentest reports often miss the mark by listing detected issues without considering operational feasibility.

  • Security awareness is most effective when it’s continuous and engaging, rather than a one-time annual training.

  • Listening to users is critical—security teams must balance technical controls with usability needs.

  • ShowMeCon continues to be a top-tier conference for hands-on security learning and industry networking.

Showmecon Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


How to Participate in a CTF

Summary:

In this episode of Exploring Information Security, host Timothy De Block sits down with James Pope, Vince Stoffer, and Blake Cahen from Corelight to discuss Capture The Flag (CTF) competitions and how they can be an invaluable learning tool for security professionals. Whether you're new to CTFs or a seasoned competitor, this episode covers everything from getting started to advanced strategies. The conversation dives into network-based CTFs, the skills required, and how Corelight’s own CTF events offer hands-on experience in network forensics.

Topics Discussed:

  • What is a CTF? Understanding how security CTF competitions work and what skills they test.

  • Getting Started with CTFs: Tips for beginners, from choosing the right event to practicing with the right tools.

  • Network Forensics and Security Analysis: How network-based CTFs differ from other styles and what data sources are most valuable.

  • Common Pitfalls and Mistakes: Strategies to avoid overthinking problems and making costly errors during competitions.

  • AI and the Evolution of CTFs: How AI is impacting CTF challenges and whether it’s changing how competitions are designed.

Guest Info:

  • James Pope – Director of Technical Marketing & Enablement at Corelight and experienced CTF organizer.

  • Vince Stoffer – Field CTO at Corelight, with a background in network security and incident response.

  • Blake Cahen – Security expert with experience in offensive cyber operations and threat hunting.

Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


Real World Windows Forensics and Incident Response with JC at ShowMeCon 2025

Summary:

In this episode of Exploring Information Security, host Timothy De Block sits down with JC, President at Snowfensive, to discuss Windows forensics, incident response, and the upcoming training session at ShowMeCon. JC shares insights on real-world forensic investigations, common challenges organizations face in responding to incidents, and how forensic methodology plays a critical role in cybersecurity operations. This episode is packed with valuable information for security professionals, IT admins, and anyone interested in digital forensics.

Showmecon Links and Resources:

Topics Discussed:

  • ShowMeCon Training Session: What attendees can expect from JC’s Windows forensics course.

  • The Reality of Incident Response: The distinction between forensic analysis and incident response and how they complement each other.

  • Ransomware Trends: The evolution from encryption-based ransomware to data extortion and the impact on organizations.

  • Real-World Forensic Cases: Examples of forensic investigations, including rapid containment strategies and detecting data exfiltration.

  • Critical Thinking in Forensics: How forensic methodology is akin to detective work, and why troubleshooting skills are essential.

  • Challenges in Reporting: Why documenting forensic findings properly is just as important as the investigation itself.

Key Takeaways:

  • Organizations are improving at responding to ransomware but still struggle with preventing data exfiltration.

  • Understanding Windows forensic artifacts is crucial for both security teams and IT administrators.

  • Effective forensic investigations require both technical expertise and strong reporting practices.

  • Training and tabletop exercises are essential for preparing organizations to handle real-world incidents.

Guest Info:

  • JC is a cybersecurity expert specializing in Windows forensics, incident response, and offensive security services. He is the President of Snowfensive and Co-Founder of the Social Engineering Community.

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


ShowMeCon: A Must-Attend Conference for Cybersecurity Pros

Summary:

In this episode of Exploring Information Security, host Timothy De Block sits down with Dave Chronister and Brooke Deneen to discuss ShowMeCon, the Midwest’s premier security conferences. Dave shares the vision behind ShowMeCon, how it stands apart from other security events, and what attendees can expect from the 2025 edition. Brooke provides insights into the logistics of running the conference and the community-driven experience that makes it special. Whether you're a seasoned security professional or new to the space, this episode highlights why ShowMeCon is a must-attend event.

Use ExploringSec to get $50 off.

Showmecon Links and Resources:

Topics Discussed:

  • The Origin of ShowMeCon: How the conference came to be and its unique place in the cybersecurity event landscape.

  • Balancing Corporate and Hacker Culture: Creating a professional yet welcoming environment that bridges the gap between security research and IT professionals.

  • Venue and Experience: Why the Ameristar Casino in St. Louis is an ideal location and what makes the event an immersive experience.

  • Speaker and Attendee Engagement: The focus on quality content, hands-on learning, and ensuring speakers are passionate and approachable.

  • Expanding to New Cities: Plans to bring the ShowMeCon model to new locations like Nashville and beyond.

  • ShowMeCon 2025 Highlights: The return of pre-conference training, CTFs, lockpicking villages, and an exciting Fallout-themed experience.

  • Building a Security Community: Encouraging new speakers, creating a welcoming space, and fostering professional development.

Key Takeaways:

  • ShowMeCon is designed for practical security education, offering content relevant to both IT and security professionals.

  • The conference prides itself on being a well-run, high-quality event where speakers and attendees engage meaningfully.

  • Training opportunities and community events, such as CTFs and lockpicking villages, enhance the overall experience.

  • ShowMeCon’s future includes expansion to other cities and continued efforts to foster an inclusive and passionate security community.

Guest Info:

  • Dave Chronister is the founder of ShowMeCon and a cybersecurity professional with over 18 years of experience in the industry.

  • Brooke Deneen plays a key role in organizing ShowMeCon and ensuring the event runs smoothly.

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and cybersecurity events.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


Enhancing Online Privacy with Anonyome Labs

Summary:

In this episode of Exploring Information Security, host Timothy De Block sits down with Dr. Paul Ashley, privacy expert and leader at Anonyome Labs, to discuss how individuals and organizations can take control of their digital privacy. They explore the growing need for online anonymity, the benefits of using pseudonymous identities, and the challenges posed by modern surveillance and data collection practices. Dr. Ashley provides insights into privacy-enhancing technologies and practical strategies for safeguarding personal information online.

Topics Discussed:

  • The Origin of Anonyomy Labs: How a team of enterprise security professionals created solutions to bring corporate-grade privacy to everyday users.

  • The Concept of Pseudonymous Identities: How services like MySudo allow users to compartmentalize their digital presence and limit personal data exposure.

  • Privacy for Everyday Users vs. High-Risk Individuals: Use cases ranging from avoiding spam to secure communications for journalists and whistleblowers.

  • Virtual Credit Cards and Secure Transactions: Reducing financial risk when shopping online and protecting personal banking details.

  • Privacy Challenges in Social Media and Online Accounts: How users can limit tracking, reduce unwanted exposure, and navigate social media restrictions.

  • Decentralized Identity and the Future of Online Authentication: The emerging shift from centralized logins to self-sovereign identity management.

  • Practical Steps to Improve Privacy: Simple actions users can take to start protecting their online presence today.

Key Takeaways:

  • Personal privacy requires active management—tools like MySudo help compartmentalize information to reduce exposure.

  • Using pseudonyms, temporary email addresses, and virtual credit cards can help protect against identity theft and financial fraud.

  • Social media platforms attempt to correlate identities, making it essential to separate accounts and use different networks.

  • Enterprises can also benefit from privacy-focused solutions to ensure secure communication and limit data leaks.

  • The move toward decentralized identity will reshape online authentication, offering greater control to individuals.

Guest Info:

Dr. Paul Ashley is a privacy advocate and security expert at Anonyomy Labs, working to develop privacy-focused technologies that empower individuals and organizations. You can learn more about Anonyomy Labs and their privacy solutions at Anonyome Labs.

Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and cybersecurity events.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


Navigating the Cybersecurity Job Market in 2025

Summary:

In this episode of Exploring Information Security, Timothy De Block welcomes Erin Barry, a recruiter with nearly a decade of experience specializing in software development and security roles. Erin shares her insights into the current job market landscape, recruitment trends, and the evolving expectations for candidates in tech and security sectors. Whether you're a job seeker or an employer, this episode is packed with valuable takeaways on hiring practices, remote work dynamics, and the impact of AI on recruitment.

Topics Discussed:

  • The Current Job Market: Erin discusses the heightened competition for roles, the evolving expectations from employers, and why remote work is no longer the standard but a perk.

  • Recruitment in Tech and Security: Insights into hiring for startups, the rise of AI-focused roles, and how companies are adapting to the rapid evolution of technology.

  • AI in Recruitment: Erin and Timothy talk about the misuse of AI in interviews, the challenges of identifying true expertise in AI, and tools being developed to combat deep fakes in recruitment.

  • Job Seeker Tips: Erin offers actionable advice for candidates, including the importance of researching companies, maintaining an online presence (e.g., GitHub, blogs), and avoiding AI during interviews.

  • Hiring Trends: Erin highlights the demand for roles in product and application security, blockchain, and AI, and shares her observations on the types of candidates employers are seeking in these fields.

Key Takeaways:

  • Startups are increasingly adopting hybrid work models with occasional in-person collaboration.

  • Companies are becoming pickier in hiring and extending interview processes to ensure the right fit.

  • Candidates claiming expertise in AI and blockchain are often scrutinized for authenticity.

  • Remote roles are becoming more competitive and limited, with a preference for local or hybrid arrangements.

  • Job seekers should invest in building an online portfolio, such as maintaining a GitHub page or personal blog, to stand out.

Guest Info:

Erin Barry is a seasoned recruiter at Code Red Partners with extensive experience placing candidates in cutting-edge tech roles. She specializes in the software development lifecycle and security positions, working primarily with startups in San Francisco, Seattle, and beyond. You can follow Erin on LinkedIn for the latest job opportunities and industry insights: Erin Barry's LinkedIn.

Links and Resources:

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


Brian Dye on Network Detection and Response (NDR) with Corelight

Summary:

In this episode of Exploring Information Security, host Timothy De Block sits down with Brian Dye from Corelight to discuss the evolution of cybersecurity, the importance of Network Detection and Response (NDR), and the challenges modern organizations face with securing their networks. Brian shares valuable insights into how Corelight leverages open-source technologies and data to provide advanced threat detection and forensics.

Key Topics Covered:

  • The Evolution of Corelight
    Brian discusses the history of Corelight, the transition from the open-source project Zeek (formerly Bro) to the Corelight company, and the importance of supporting the open-source community. He also touches on how the company has grown as cybersecurity needs have evolved.

  • Network Detection and Response (NDR)
    Corelight's NDR solutions help organizations detect advanced threats that bypass traditional security controls like firewalls and EDR. Brian explains the differences between EDR and NDR, and why both are essential for a comprehensive cybersecurity strategy.

  • AI and Machine Learning in Security
    Brian dives into how Corelight has embraced AI and machine learning, particularly with generative AI (GenAI), to improve threat detection and response capabilities. He shares examples of how organizations are using GenAI to automate security workflows and accelerate alert investigations.

  • The Changing Threat Landscape
    Brian talks about how attackers are evolving their tactics, moving away from malware-based attacks to techniques like "living off the land" (LoL) to avoid detection. He discusses the importance of understanding these advanced attack methods and how NDR tools help provide the data needed to investigate and respond.

  • Real-World Success Stories
    Brian shares examples of how Corelight has helped organizations respond to cyber threats, including a ransomware attack scenario where Corelight's tools provided the necessary data to help the victim organization make informed decisions about whether to pay a ransom.

  • The Future of Network Security
    Looking ahead, Brian outlines the future of Corelight and its focus on expanding its data capabilities to enable more advanced detections. He highlights the importance of data as a foundational element for security and how Corelight plans to continue innovating in the NDR space.

Guest Bio:

Brian Dye is the Chief Product Officer at Corelight, a leading provider of Network Detection and Response (NDR) solutions. With years of experience in cybersecurity, Brian is dedicated to helping organizations defend against advanced threats using open-source tools and innovative technology.

Links and Resources:

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


Solving Compliance Complexity with risk3sixty

Summary:

In this episode of Exploring Information Security, host Timothy De Block is joined by Christian Hyatt, CEO of risk3sixty, a company that specializes in helping businesses with security and compliance. Christian shares his thoughts on how organizations are dealing with the increasing complexity of compliance programs, third-party risks, and the role of offensive security in bridging the gap between compliance and risk management.

Key Topics Covered

  • What is risk3sixty and the Problem it Solves?
    Christian discusses how risk3sixty helps organizations streamline and harmonize complex security and compliance programs, providing significant cost savings and efficiency.

  • The Importance of GRC Transformation
    Christian explains the role of Governance, Risk, and Compliance (GRC) transformations in helping businesses manage multiple frameworks, such as ISO, SOC 2, and NIST.

  • Offensive Security and Compliance
    How risk3sixty integrates offensive security services like red team engagements and continuous pen testing with a focus on both compliance and true risk management.

  • The Evolution of Security and Compliance
    The challenges and opportunities in integrating security directly into the development lifecycle, and how risk3sixty is positioning itself to lead the way in managing third-party risks.

  • AI and the Future of Compliance
    Christian’s perspective on how AI is impacting compliance roles and what it means for the future of security and risk management.

Highlights

  • risk3sixty’s Full Circle GRC platform streamlines compliance management, helping businesses save time and reduce costs.

  • The increasing need for businesses to manage third-party risks as part of their cybersecurity strategy.

  • How risk3sixty is adapting to the changing cybersecurity landscape, especially in highly regulated industries.

Guest Bio

Christian Hyatt is the CEO of risk3sixty, a leading provider of security and compliance services. With years of experience in helping businesses navigate complex GRC challenges, Christian is passionate about making security more efficient and accessible to organizations of all sizes.

Links and Resources

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]