Hurricane Labs InfoSec Podcast

The Hurricane Labs InfoSec Podcast puts a working security team's conversations on the record. Heather introduces the topics and leads the discussion, sometimes with one colleague and sometimes with three. Tom Kopchak, Hurricane Labs' Director of Technical Operations, appears across several episodes, while SOC architect Meredith and Dennis Goodlett join for others. Titles carry working labels such as 'SOC Talk' and 'Pentest Perspective', which fairly map the ground: security operations, attack simulation and the news that touches both. Current events come with background. In 'SOC Talk: Cyber Safety Review Board and the Log4j Report', Heather lays out the sequence from President Biden's executive order on the nation's cybersecurity to the Department of Homeland Security's new review board, whose first assignment was a report on Log4j. The talk then turns to disclosure, with the argument that organizations pressing charges against people who report a flaw only scare off the next reporter. The closing tip is practical: feed recent Qualys scan results into alerting, so traffic aimed at a host known not to be vulnerable stops posing as a true positive. 'SOC Talk: The Russia-Ukraine War Follow-up' picks up the Biden administration's March 21st statement and its warnings that Russian nation-state actors could target American businesses. A card game, Backdoors and Breaches, comes up as a training tool, valued because it pulls players out of their own specialty. Field stories give the show its texture. 'Pentest Perspective: Taking a Look at Social Engineering' starts from Verizon's 2021 Data Breach Investigations Report and moves to what the team has run into. One point lands hard: when staff routinely receive legitimate emails they had no reason to expect, telling real from fake gets close to impossible, and a defense built on nobody clicking a bad link is not enough. In 'SOC Talk: Red Teaming for NECCDC', Tom Kopchak and Meredith recall attacking student teams charged with keeping systems secure and business running at the Northeast Regional of the Collegiate Cyber Defense Competition. The standout moment is a red teamer walking through rooms with a badge in plain view and meeting little challenge. Once teams learned to watch visitors, that attention gave a teammate free run of the room. The two-part 'Teaching and Learning Cybersecurity: Closing the Skills Gap' widens the lens to education. Part 1 draws on Tom Kopchak's experience teaching pen testing and defense at Baldwin-Wallace and supporting competitions such as CPTC, and argues that communication counts as much as technical skill, introverts included. Part 2 turns to building training programs, borrowing lessons from teaching high school English at Akron Alternative Academy: let learners move, give them agency, never drone. Tom jokes that the series split in two because both of them like to talk too much. Episodes point toward blog posts and linked resources, and the sign-off holds steady: stay safe. For a first listen, the NECCDC episode shows the team at its most anecdotal, and the Log4j episode shows how it handles policy.