Security by Default

Security by Default is a cybersecurity podcast hosted by Joseph Carson, a renowned ethical hacker and security expert. Each episode dives into the latest security trends, real-world threats, and practical advice for staying safe in the digital world. With insightful interviews and clear explanations, Joseph makes complex topics accessible for both IT professionals and curious listeners alike.

Security by Default is a technology podcast hosted by Joseph Carson, with 39 episodes on record and a Required Pod Score of 80.

Joseph Carson hosts Security by Default, a technology show with 39 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #40

  Passwords, Passkeys & Rogue AI Agents | Credentials in the Age of AI with Evil Mog

  Sep 28, 202639 minS1

  We assert that agentic AI constitutes a profound and immediate threat to passwords, passkeys, and credential stewardship when such agents are afforded unfettered operational or contractual authority without deterministic guardrails. I describe, with technical specificity, how agents that hold passkeys or password-manager access can act autonomously to transact, alter accounts, or execute legally binding operations, and we categorize those risks into task-level, operational, and contractual modes of delegation. We argue that the remediation imperative involves explicit delegation models, ephemeral and auditable identities, and cryptographic assertions that bind an agent’s scope of action to a human owner. I counsel continued adoption of hardened password practices and password managers, combined with resilient offline backups and dual-control or deterministic controls layered atop probabilistic AI systems. We further insist that security-by-default, mandatory auditability, and standards for AI skill and supply-chain review are prerequisites to any safe integration of AI with authentication systems. Finally, I exhort practitioners to prioritize availability, integrity, and accountability alongside confidentiality so that credential resilience endures in an era of accelerating AI capability. We offer clear, practical guidance for individuals and organizations to protect credentials in the age of AI. I recommend using a zero-knowledge password manager and enabling secure backups. Evil Mog affirms that printed or offline copies of critical credentials are valid resilience measures when they are managed and backed up properly. We advise random and unique passwords of appropriate length, routine backups of vaults, and giving trusted delegates access via documented procedures rather than ad hoc sharing. For family and estate planning, we explain how offline copies or delegated access can help manage accounts after death. We also recommend operational controls when using agents. Always run agents with least privilege. Use ephemeral tokens for short-lived tasks. Maintain strong audit logs that tie agent actions back to an owner. Keep humans in the loop for operational and contractual actions. We advise treating AI as an assistant for tasks and threat detection, not as a trusted keeper of passwords without deterministic guardrails. Finally, we remind security teams to prioritize availability and integrity alongside confidentiality and to make secure defaults easy to use so users do not bypass protections. Takeaways: I explain three agent categories: task, operational, and contractual, each requiring different controls and audit. We caution against giving probabilistic AI full control of password managers without deterministic guardrails. I recommend using zero knowledge password managers, backing them up, and keeping an offline printed copy. We note that passkeys can be compromised if they are not bound to secure hardware or secure elements. I urge clear delegation, ephemeral identities, and auditable signatures when agents act on our behalf to ensure accountability. We advise keeping humans in the loop for high risk operational actions and verifying AI outputs before execution. I emphasize secure by default design, reducing friction without disabling protections, to prevent users from bypassing security.

  ListenShow Notes
• 

  Episode #39

  When a Simple Breach Became a Crisis: Lessons We Learned | Lukas Hlavicka

  Sep 14, 202632 minS1

  I discuss with Lukas Hlavicka how ordinary security incidents can escalate into full-blown crises when organizations lack preparation, reliable backups, and secure deployment pipelines. We share stark war stories, from backups that were never actually taken to compromised software deployment systems and a ransomware attack that exposed six months of bank fraud. Lukas draws on over a decade of incident response experience, including leadership of a national CSIRT and work in the private sector. We describe common failure points: unknown assets and third‑party links, intertwined IT and OT systems, missing evidence, unclear roles for decision and containment, and compromised CI/CD. We stress clear, practical steps: maintain offline incident plans and backups, map assets and dependencies, secure and monitor deployment pipelines, and practice response with defined authorities. This episode targets any organization that thinks “it won’t happen to us” and seeks concrete lessons to prevent incidents from becoming crises. Takeaways: I learned that many incidents become crises because organizations do not know what assets they own or how they connect to third parties. We must keep offline backups and verify that backups are actually taken and restorable before incidents occur. I saw attackers abuse cloud managed security products and deployment pipelines to gain full network access quickly. We found that unclear roles and slow approval processes delay containment and allow the attacker to spread further. I observed that organizations often destroy evidence or change systems in ways that hinder forensic investigations. We recommend practicing incident response, keeping plans offline, and retaining institutional memory to avoid repeating past mistakes. I noted cases where ransomware accidentally revealed long running fraud and showed the need to follow financial trails in investigations. We must monitor CI/CD and software supply chains continuously because compromise there can implant persistent backdoors.

  ListenShow Notes
• 

  Episode #38

  From Legacy to Modern PAM: A Migration Playbook with Erik Siebler

  Aug 31, 202648 minS1

  Navigating the intricate landscape of identity security has evolved dramatically over the past two decades. Once characterized by a mere username and password, the contemporary environment demands that employees manage an astonishing array of digital identities—approximately one hundred per individual, not accounting for the emerging complexities introduced by agentic AI. Joe Carson engages Erik Siebler, a seasoned professional with fifteen years of experience in Identity Governance Administration (IGA), Privileged Access Management (PAM), and authentication, to unravel the concept of 'legacy' within identity security. They delve into the defining attributes of legacy PAM systems, which are inherently infrastructure-bound, protocol-heavy, and tailored for a bygone era dominated by servers and routers. Erik elucidates the common pitfalls organizations encounter, particularly the tendency to misinterpret modern PAM solutions as mere expensive password managers, thus neglecting the essential integration of security into existing workflows to achieve frictionless access. As the dialogue progresses, the focus shifts to the forefront of the identity security discussion: agentic AI. Erik articulates a nascent failure pattern in which one AI agent, denied access, may exploit another to circumvent restrictions, thereby complicating the landscape of privileged escalation. This new paradigm necessitates a reassessment of traditional security measures, as privilege escalation becomes increasingly relevant not only to attackers but also to the automated processes within organizations. The episode culminates in a practical migration playbook, emphasizing the importance of product selection, side-by-side rollouts, and key-user engagement, ultimately aiming to equip listeners with actionable insights for effectively transitioning from legacy PAM solutions to modern frameworks. Takeaways: The evolution of identity management has transitioned from simple usernames and passwords to managing nearly 100 digital identities per employee in modern organizations. Legacy PAM systems are predominantly infrastructure-bound and protocol-heavy, failing to accommodate the needs of contemporary workflows and user experiences. The advent of agentic AI introduces new challenges in privilege escalation, necessitating a reevaluation of traditional security measures and access controls. Successful migration from legacy PAM systems requires a meticulous strategy, including product selection, user engagement, and the establishment of critical metrics to measure success. Zero friction in user experience is as crucial as implementing zero trust principles, emphasizing seamless integration into existing workflows. Organizations must acknowledge the technical debt associated with legacy systems and prioritize modernization to enable effective security in a hybrid and cloud-driven environment.

  ListenShow Notes
• 

  Episode #37

  Navigating the Convergence of Physical Security and Digital Access | Daniel

  Aug 17, 202630 minS1

  Daniel Raines, a luminary in the realm of electronic security, shares his extensive journey through the intricate landscape of physical security and digital access. With three decades of experience, he has transitioned from hands-on installation of access control systems to software development, addressing vulnerabilities and enhancing security measures. Our discourse delves into the convergence of physical and digital security, exploring the nuances of vulnerability disclosure and the industry's response to emerging threats. Raines elucidates the complexities of hard-coded encryption keys and the imperative for robust security practices, particularly as the industry shifts towards mobile credentials and biometric solutions. This episode serves as a profound exploration of security's evolving nature, emphasizing the significance of adapting to technological advancements and fostering a culture of continuous learning and improvement. Daniel Raines' extensive career within the electronic security industry, spanning over three decades, serves as a testament to the evolving landscape of physical security and digital access. Initially immersed in the practical aspects of the field, Raines dedicated the first fifteen years to the installation of physical access control systems, including surveillance cameras and biometric solutions. However, he subsequently transitioned into software development, focusing on creating robust systems for access control and security research. This shift was catalyzed by his encounters with software vulnerabilities, which sparked a deep dive into ethical hacking and vulnerability disclosure. Raines' narrative illustrates not only his personal journey but also the critical intersection of physical and digital security, emphasizing the need for improved practices in vulnerability reporting and response within the industry. The discussion between Raines and the host, Joe Carson, delves into the intricacies of vulnerability disclosure in the realm of access control systems. Raines categorizes companies' responses to vulnerability reports into three distinct groups: those that are receptive and proactive, those that provide minimal feedback, and those that are entirely unresponsive. This classification underscores the varying maturity levels within the industry regarding security practices. Furthermore, Raines highlights the pressing issue of hard-coded credentials and encryption keys, which present significant security risks if not adequately addressed. The conversation also touches on the ongoing evolution towards mobile credentials and biometric systems, reflecting a broader trend towards enhancing security while minimizing user friction. Raines' insights serve as a clarion call for greater accountability and proactive measures in safeguarding both physical and digital access points. In a landscape increasingly characterized by the convergence of physical security and digital access, Daniel Raines' experiences and insights illuminate the paramount importance of vigilance and innovation in the electronic security industry. His journey from hands-on installation to software development exemplifies the dynamic nature of the field, where technological advancements continually reshape the strategies employed to secure environments. Raines articulates the necessity of adopting best practices in addressing vulnerabilities, particularly emphasizing the detrimental effects of hard-coded keys and unsecured systems. As the conversation progresses, it becomes evident that the industry is at a pivotal juncture, with a notable shift towards mobile credentials and cloud-based solutions. This transition not only enhances operational efficiency but also raises questions about data privacy and security in the cloud. Raines’ reflections serve as a vital reminder of the ongoing challenges and opportunities within the realm of electronic security, urging both practitioners and organizations to remain proactive in adapting to the evolving landscape. Takeaways: Daniel Raines has accumulated approximately three decades of experience in the electronic security industry, transitioning from hands-on installations to software development. The conversation highlights the critical intersection of physical security and digital access control, illustrating how these domains converge in today's security landscape. Raines emphasizes the importance of ethical vulnerability disclosure practices within the electronic security industry, advocating for responsible reporting of security flaws. As technology evolves, there is a notable shift from traditional physical access methods to more advanced mobile credentials and biometric solutions, enhancing security measures. The discussion reveals that hard-coded encryption keys and default passwords remain prevalent vulnerabilities, underscoring the need for improved security practices in software design. Raines advocates for a proactive learning approach, encouraging individuals interested in security to engage practically with hardware and software to deepen their understanding.

  ListenShow Notes
• 

  Episode #36

  L0pht Legend Chris Wysopal on the Evolution of Application Security

  Aug 3, 202652 minS1

  Chris Wysopal, a distinguished figure in the realm of cybersecurity and a celebrated L0pht legend, engages in a profound dialogue with Joe Carson, delving into his remarkable journey from scavenging for Unix manuals to pioneering modern application security. Central to the discussion is the evolution of application security practices, particularly as they pertain to the emergence of artificial intelligence in coding. Wysopal recounts the storied ascent of the L0pht, traversing through pivotal roles at @stake and Symantec, ultimately culminating in the establishment of Veracode. The episode further explores the implications of AI-generated code on security, shedding light on the challenges and opportunities that this technological advancement presents for the cybersecurity landscape today. Listeners are invited to glean insights from Wysopal's extensive experience, which not only reflects on the past but also poses critical questions about the future of cybersecurity practices in an increasingly automated world. Chris Wysopal, a luminary in the realm of cybersecurity, recounts his remarkable journey from the nascent days of hacking to the forefront of application security. He shares anecdotes of his early experiences, such as dumpster diving for Unix manuals and the camaraderie fostered within the L0pht, a hacker collective that became a beacon of innovation and activism in the 1990s. Wysopal's narrative is interspersed with reflections on the evolution of cybersecurity and the societal implications of technology, particularly as he transitioned from the L0pht to @stake and subsequently co-founding Veracode. The conversation delves into the intricacies of application security, the challenges posed by AI-generated code, and the pressing need for a paradigm shift in how security is integrated into the software development lifecycle. This episode is a compelling exploration of Wysopal's contributions to the field and his insights into the future of cybersecurity in an increasingly complex digital landscape. Takeaways: Chris Wysopal's journey illustrates the evolution of cybersecurity from its nascent stages to its current complexity. The transition from the L0pht to Veracode highlights the necessity of adapting to modern security challenges. AI-generated code represents both an advancement and a significant challenge for application security today. Understanding the security landscape requires a holistic approach, integrating hardware, software, and human factors. The importance of early intervention in the software development life cycle for effective security cannot be overstated. Continuous learning and adaptation are essential in the fast-paced field of cybersecurity, especially with emerging technologies.

  ListenShow Notes

Recent guests on Security by Default. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.