Assessing risk at the speed of change, coordinated disclosure, and the news - Danielle Russell - ESW #484
Summary
Danielle Russell from Nudge Security discusses assessing risk at the workforce edge, emphasizing the need for visibility into shadow IT and AI-driven data integrations to manage third-party risks effectively. The hosts then debate the state of coordinated disclosure, arguing that recent leaks reflect systemic design flaws rather than AI-specific issues. The episode concludes with enterprise security news covering software liability, a major bank heist, and new vulnerabilities in SSH and MS Paint.
Topics discussed
Episode introduction and agenda overview
National Fried Chicken Sandwich Day banter and announcements
Nudge Security: Workforce edge and technology adoption
Risk-based third-party vendor management strategies
Automated nudging and decentralized IT administration
Agentic AI for scale risk and orphaned assets
Supply chain risks and unmanaged data integrations
Coordinated disclosure challenges and recent leaks
Disclosure maturity levels and security.txt adoption
Ampersand Truth: Formal verification funding and skepticism
UK software liability laws and third-party code risk
PHP-to-Shell firewall exploitation and patching delays
Asterisk SSH vulnerability in musl-based systems
Banking breach via phishing and YubiKey limitations
IoT freezer hacks and secure default configurations
Android TV boxes and state-sponsored data collection
AI agent swarms and offensive security automation
Windows Paint vulnerability and endpoint DLP gaps
Listen ad-free on Castria