Cybersecurity Today

RSAC: Retiring "APT," FCC's US-Made Router Ban, Zoom Call Scraping, Iran-Targeting Wiper, and Cyber Terrorism Insurance
From RSAC 2026, host David Shipley highlights ESET researcher Robert Lipowsky's argument to retire the overused "advanced persistent threat" label and instead describe actors by motivation and activity, noting blurred lines between nation-state and criminal tooling. He also reports RSAC vendor trends (zero trust fading, "agentic AI" everywhere) and standout booth themes. In Washington, the FCC bans authorization of any new Wi‑Fi router models not made in the United States, citing supply-chain risk and attacks like Volt Flax and Salt Typhoon, impacting an industry largely manufacturing abroad unless exemptions are granted with plans to reshore. The episode details Webinar TV allegedly joining public Zoom links to record calls and publish AI-generated podcast recaps, and a Kubernetes-targeting campaign linked to the Trivy supply-chain attack that deploys an Iran-checking wiper. Finally, Treasury seeks comments on expanding the terrorism risk insurance backstop (TRIP) to cover cyber losses.
Cybersecurity Today  would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale.  You can find them at Meter.com/cst
 
00:00 Sponsor Meter Intro
00:18 Headlines Preview
00:58 Retiring The APT Label
02:51 RSAC Floor Trends
05:08 FCC Router Ban
06:43 Zoom Calls Turned Podcasts
09:29 Iran Targeting Wiper
10:57 Cyber Terrorism Insurance Debate
13:15 Wrap Up And Thanks
13:44 Sponsor Meter Outro

Compliance Startup Audit-Faking Claims, Trivy Supply-Chain Backdoor, Russia Targets Signal/WhatsApp, and Iran-Linked Stryker Disruption
Cybersecurity Today  would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale.  You can find them at Meter.com/cst
This episode covers allegations that Y Combinator-backed compliance startup Delve helped customers fake privacy and security audits by generating fabricated evidence that auditors then rubber-stamped, alongside Delve's denial and a report of sensitive Delve data being externally accessible. It also details a TeamTNT/Team PCP-style supply-chain compromise of Aqua Security's Trivy scanner via GitHub build and tag tampering, briefly distributing a backdoored release that stole cloud credentials, SSH keys, tokens, and more, with guidance to treat affected environments as fully compromised and rotate secrets. The FBI and CISA warn of Russian intelligence-linked phishing targeting Signal and WhatsApp accounts through social engineering and malicious QR codes. Finally, it describes the real-world impact of an Iran-linked Handala cyberattack on Stryker, disrupting custom implant logistics and delaying surgeries.
00:00 Sponsor Message Meter
00:18 Headlines Overview
00:48 Delve Audit Allegations
03:27 Trivy Scanner Backdoor
06:01 Russian Phishing Signals
08:54 Stryker Attack Fallout
11:30 Wrap Up And RSAC
11:48 Sponsor Message Meter

Cybersecurity Isn't Managing Risk—It's Managing Threats... And That's the Problem
Host David Shipley speaks with Jeff Gardiner, a former university CISO and now at Morgan Stanley, about Gardiner's doctoral research arguing that cybersecurity has structurally misclassified "risk management" as threat management. 
Gardiner explains that real risk is an expected loss calculation (impact × likelihood), while many cybersecurity frameworks and training emphasize vulnerabilities, exploitability, and system configuration without likelihood or business impact. He describes examples where teams labeled unlikely issues as "extremely high risk," discusses interviews where leaders universally expect cybersecurity staff to be risk managers, and cites findings that only about 11% of cybersecurity professionals actually perform risk calculations. Gardiner outlines a practical approach using qualitative likelihood and impact scales, prioritization, and clearer business framing, and notes ongoing discussions with NIST to improve the NICE framework.
Cybersecurity Today  would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale.  You can find them at Meter.com/cst

00:00 Sponsor Message
00:19 Meet Jeff Gardiner
01:51 Career Journey Origins
03:23 TLS Risk Epiphany
05:06 What Is Compute Canada
06:38 Risk Versus Threat
08:35 Why Labels Matter
11:13 Likelihood And Impact
12:26 Teaching Risk Qualitatively
15:29 Why Prioritize Risk
20:36 Training Frameworks Flaw
25:13 Research Frustrations
25:51 Risk Management Wins
26:44 Why CISOs Burn Out
27:43 Speaking Executive Risk
29:22 Teach Risk Broadly
31:36 Biases and Better Judgments
35:17 Sexy Scary vs Real Risk
36:12 Convincing the Room
39:15 Start Simple Frameworks
41:36 Risk Quadrants and Delegation
45:30 Mentorship and NIST V3
47:57 Wrap Up and Sponsor

FBI Seizes Iran-Linked Handala Leak Site After Stryker Intune Wipe Attack; Apple iPhone Exploit Patch; North Korean Fake IT Workers Grow
Cybersecurity Today  would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale.  You can find them at Meter.com/cst
The episode reports that the FBI has seized the data leak site used by the Iran-linked hacktivist group Handala, which has been widely linked to the Stryker attack where attackers compromised admin accounts, stole data, and used Microsoft Intune to remotely wipe and factory reset roughly 80,000 managed devices. CISA and Microsoft warn organizations to harden Intune and identity controls with least privilege, role-based access, MFA, conditional access, and requiring multi-admin approval for sensitive actions like device wipes. Apple urges iPhone users to update after fixing actively exploited flaws used in targeted, sophisticated campaigns, noting risks even for those who think Apple devices aren't targeted. The show also highlights new FLAIR research showing North Korean operatives continue infiltrating Western firms as remote IT workers using stolen or fabricated identities, exploiting weak hiring verification and broad access.
LINKS
https://flare.io/learn/resources/north-korean-infiltrator-threat

00:00 Sponsor Message Meter
00:19 Headlines And Intro
00:46 FBI Seizes Handala Leak Site
02:31 CISA And Microsoft Intune Guidance
04:37 Apple iPhone Update Warning
06:10 North Korean Fake IT Workers
07:56 Links Sharing And Wrap Up
08:29 Sponsor Thanks And Sign Off

Medical Device Breaches, Anti-Scam Pledge Scrutiny, AI Font Trick, and Iran-Linked Cyber Updates.
Cybersecurity Today  would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale.  You can find them at Meter.com/cst
The episode covers several cybersecurity stories: Intuitive Surgical disclosed a March 12 phishing-led intrusion where stolen credentials enabled access to its internal administrative network and data theft (customer/business contacts and employee records), while clinical platforms and Da Vinci/Ion systems remained unaffected. Eleven tech and retail firms including Google, Amazon, and OpenAI pledged to share threat intel on scams, amid skepticism and Verafin figures estimating $4.4T in global financial crime in 2025 and rising AI-driven fraud. LayerX demonstrated a font/CSS "glyph substitution" technique that shows humans a malicious command while AI assistants read benign text; Microsoft addressed it, while others deemed it out of scope. In Iran-war updates, senior Iranian cyber figures were reportedly killed; Iran-linked group Handala's Stryker attack allegedly wiped nearly 80,000 devices via compromised admin accounts and Intune, with further unverified leak claims. Denver crosswalk speakers were hacked due to default passwords.
 
00:00 Sponsor Message Meter
00:19 Medical Device Breach
01:52 Phishing Still Wins
02:32 Tech Pledge Against Scams
03:43 Fraud Numbers And AI
05:49 Font Trick AI Bypass
07:22 Vendor Responses Lessons
09:03 Iran Cyber War Updates
10:00 Stryker Intune Wipe Attack
11:07 More Iranian Claims
12:17 Denver Crosswalk Hack
13:10 Wrap Up And Signoff
13:33 Sponsor Outro Meter