Never Miss An Episode | Subscribe Now
Home
Shows
ShopAboutWork With Us
Creative Mastermind
CyberCreatorCon2023
Never Miss An Episode | Subscribe Now

April 14, 2021

Vishing, Smishing and STIR/SHAKEN w/ Mike Manrod

by Cyber Ranch

Listen Now

Vishing, Smishing and STIR/SHAKEN w/ Mike Manrod

April 14, 2021 • Cyber Ranch

00:00:00

Show Notes

Welcome to The Cyber Ranch Podcast, recorded under the big blue skies of Texas, where one CISO explores the cybersecurity landscape with the help of friends and experts! Today, host and CISO Allan Alford interviews Mike Manrod, CISO at Grand Canyon Education. Mike has done quite a bit of research on vishing, smishing and the upcoming STIR/SHAKEN legislation meant to combat those two. To start the conversation, Allan asks Mike to share a little about himself, his background in information security and what he does at his day job. Mike started as an IT technologist who orginally resented the security team for slowing down technology projects. Then a friend took him to a security conference, and the rest is history. Mike explains what vishing and smishing are, contrasting them to traditional phishing. Mike and Allan discuss personally targeted vishing and smishing vs. attacks targeted at organizations. Allan and Mike cover the new STIR/SHAKEN legislation and related RFCs, along with the technical limitations inherent in the approach. Finally, Allan asks Mike what keeps him going in cybersecurity, including technical challenges and a strong infosec community. Key Takeaways 0:24 Allan introduces Mike 1:05 Mike explains how he got into cybersecurity and what his daily CISO life is like. 2:48 Mike explains what vishing and smishing are. 3:32 Mike explains the unethical vishing vs. truly illegal vishing and how they might target an organization vs. an individual. 7:18 Mike explains how most smishing is targeted at individuals. SIM swapping and other techniques are generally what is used against enterprises. 8:00 Mike says that smishing is most often used to introduce malware or harvesting user credentials. 9:31 Mike says that smishing, vishing and robocalling definitely mimic the ransomware world where lower-level, even non-technical criminals run the front line of attack. 11:34 Mike compares STIR/SHAKEN to the anti-phishing technologies DKIM, DMARC and SPF. 11:49 Allan explains that those email technologies are opt-in and only effective if all parties choose to opt in. 12:31 Mike explains what STIR/SHAKEN stand for and how they work - they are based on a series of RFCs. 13:43 Mike explains the FCC June 30, 2021 deadline for IP-based carriers to adhere to STIR/SHAKEN. TDM and Cellular networks are asked to implement in good faith. 15:48 Mike says that STIR/SHAKEN is a great step in the right direction. The nature of the problem is that the 'from' value is user-controlled in telco communications. 17:29 Mike sas that an enforced heirachy of tokens will solve the problem ultimately. 18:15 Mike recommend RFC 7340 as the best definition of the problem statement for the telephony challenged end-to-end. 18:45 Mike explains how STIR/SHAKEN also impacts smishing - noting that iMessage and other SMS-derived technologies already offer better security than voice technologies. 19:29 Mike states that a paradigm with certificates bound to number ranges or account ranges is the real solution to the problem. 21:01 Mike explains that fun technical challenges are why he stays in information security - a lack of bordeom. 21:58 Mike also names community as another reason he stays in infosec. Links: Learn more about Mike Manrod on LinkedIn Follow Allan Alford on LinkedIn and Twitter Learn more about Hacker Valley Studio and The Cyber Ranch Podcast Sponsored by our good friends at Axonius
Read more

Recent Episodes

View All

November 29, 2023

12 Questions for 12 Guests LIVE! at CISO XC

by Cyber Ranch

Allan takes the show on the road again, this time at his all-time favorite conference: CISO XC! He asks a unique question of each guest, who represent a great deal of breadth in our industry: Dave Belanger, CISO at Bestow Insurance - What is the most...

Listen Now
November 22, 2023

American Thanksgiving Holiday

by Cyber Ranch

Howdy, y'all!  Allan is taking this week off to spend time with family and to give thanks for all the wonderful things in his life - including y'all! For those who don't track it, there is no Cyber Ranch Podcast four times  a year: American Thanksgiv...

Listen Now
November 15, 2023

Cybersecurity Awareness Month CALL TO ACTION - The Conclusion!

by Cyber Ranch

Warning, there might be some naughty language in this one! The challenge was issued!!!! Allan teamed up with TWO other podcasts to take on the insufferable marketing that floods the cybersecurity industry in the month of October! Who won??? "Won"? Th...

Listen Now
November 8, 2023

SEC/SolarWinds Legal Analysis w/ Evan Wolff

by Cyber Ranch

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  Our guest today is Evan Wolff, partner at Crowell & Moring, and Allan's favorite cyber attorney.  Evan has led and managed 100s of investigations including cybersecurity, data breach, insider...

Listen Now
November 1, 2023

Defining Budgets with Tim Rohrbaugh

by Cyber Ranch

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  That’s Tim Rohrbaugh, Founder/Principal at DefaultDenySec, former CISO for JetBlue Airways, advisor, investor: yup!  Another Cyber Ranch guest with an awesome history!  Tim and Allan were chattin...

Listen Now
October 25, 2023

The New SEC Regulations with Jack Powell

by Cyber Ranch

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  We're joined today by Jacqueline (AKA “Jack”) Powell, CISO at Allianz Life and former Deputy CISO at Hanes.  She has also consulted, and has worked at Chevron, General Dynamics, and SACI.  Jack h...

Listen Now
October 18, 2023

Building Excellent Teams w/ Kymberlee Price

by Cyber Ranch

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  That’s Kymberlee Price, strategic security consultant, Black Hat content review board member, former Sr. Director of Product Security at New Relic, former Principal Security Manager at Microsoft ...

Listen Now
October 11, 2023

Bad Behaviors: A Better Way LIVE! with Chris Tillett

by Cyber Ranch

Chris Tillett is a well-known figure in our industry.  He is in product management and R&D at Palo Alto Networks.  He is also a great guy, funny, and can wield the snark quite well.  He is the perfect foil for Allan Alford as the two of them take...

Listen Now
September 27, 2023

Permissions Management w/ Ron Nissim

by Cyber Ranch

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  Joining Allan this week is Ron Nissim, CEO @ Entitle.  Yes, this is one of our rare shows with a vendor as a guest.  Why?  Because in this case, the vendor was more highly informed than any of Al...

Listen Now
September 20, 2023

The Cybersecurity Efficacy Gap w/ AJ Grotto

by Cyber Ranch

Allan is joined by AJ Grotto: William J. Perry International Security Fellow and Founding Director of the Program on Geopolitics, Technology and Governance at Stanford University.  He also serves as the faculty lead for the cyber policy specializatio...

Listen Now