Light

Episode #1054 Quiz

Bots in the Belfry
Date: 2025-12-02 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Episode 1054 covers a major supply chain breach involving Gainsight apps on Salesforce, exposing data from over 200 companies due to compromised external API tokens. Cisco announces a security-first initiative removing insecure defaults and enabling real-time vulnerability shields.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what is the primary security issue demonstrated by the Gainsight/Salesforce breach involving over 200 companies?

Question 1

According to the episode, what is the primary security issue demonstrated by the Gainsight/Salesforce breach involving over 200 companies?

The compromise originated from an affiliated third-party app's external connection to Salesforce, leading to unauthorized access via API tokens. Employees of Salesforce were tricked by social engineering, leading to direct access to customer data. The breach was caused by exploiting a zero-day vulnerability in Salesforce's cloud infrastructure. The Salesforce platform had a critical vulnerability allowing direct breaches of its core system.

Question 2: What is the main security improvement Cisco announced in their 'Resilient Infrastructure' initiative as detailed in the episode?

Question 2

What is the main security improvement Cisco announced in their 'Resilient Infrastructure' initiative as detailed in the episode?

Implementing mandatory hardware token authentication for all router administrative access. Making secure configurations, protocols, and features the default and providing proactive alerts when insecure choices are made, with eventual removal of insecure options. Allowing customers to choose between secure and insecure settings without any default preference. Complete removal of all default security features to increase performance speed.

Question 3: Regarding Passkeys, passwords, and YubiKeys discussed in the episode, which best practice is recommended for highest security with usability?

Question 3

Regarding Passkeys, passwords, and YubiKeys discussed in the episode, which best practice is recommended for highest security with usability?

Passkeys are inherently insecure and should never be used outside of hardware tokens. Use Passkeys whenever supported, store them in a cross-platform password manager, and reserve YubiKeys for highly sensitive accounts where physical presence is acceptable. Use a YubiKey for every site, including low-value accounts, to maximize uniform hardware security. Always use only passwords for all sites to keep credentials simple and uniform.

Question 4: What is the significance of NAT routing in the effectiveness of the GreyNoise 'botcheck' service described in the episode?

Question 4

What is the significance of NAT routing in the effectiveness of the GreyNoise 'botcheck' service described in the episode?

NAT routing allows botcheck to evaluate the behavior of all devices on a LAN by checking only the single public IP shared by the network. NAT routing prevents the detection of any bot activity against devices behind a router, making botcheck ineffective. NAT routing forces GreyNoise to scan each individual device separately to identify bots. The botcheck service only works on networks that do not use NAT routing.

Question 5: What technical reason does the episode give for why unpowered SSDs lose their data over long storage periods, despite common beliefs?

Question 5

What technical reason does the episode give for why unpowered SSDs lose their data over long storage periods, despite common beliefs?

The SSD controller automatically deletes old data from cells it deems unused, leading to data loss when unpowered. Keeping SSDs powered on prevents data degradation by allowing controllers to refresh marginal cells continuously. SSD data retention degradation primarily depends on storage temperature, with higher temperatures accelerating charge loss in memory cells. Unpowered SSDs autonomously rewrite their own data periodically to maintain cell charge, preventing data loss.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.