7 Minute Security cover art

7 Minute Security

7 Minute Security

Written by: Brian Johnson
Listen for free

7 Minute Security is a weekly information security podcast focusing on penetration testing, blue teaming and building a career in security. The podcast also features in-depth interviews with industry leaders who share their insights, tools, tips and tricks for being a successful security engineer.Brian Johnson Politics & Government
Episodes
  • 7MS #736: Securing Your Family During and After a Disaster – Part 9
    Aug 21 2026

    Hey friends! Today's another slice of our Securing Your Family During and After a Disaster miniseries, and fair warning — it's a bit of a Friday mood-ruiner. It's been almost two months since my dad passed, and we've moved into a phase nobody prepared me for. Here's what we get into:

    • The paperwork nobody thinks about — my mom still doesn't know what her monthly income looks like now, and the answer is buried in a box somebody lost the key to.
    • Divvying up a lifetime of stuff — and why our 2019 house fire completely rewired how I think about possessions.
    • Dumpster weekend — my wife makes keep-or-toss calls like a Terminator. Also: my dad owned 60 rakes, and a spirited family debate about the resale value of bee spray.
    • Sell it or pitch it? — why we mostly gave up on Facebook Marketplace mid-cleanout, and my one non-negotiable rule for meeting strangers to hand off your stuff.
    • The conversation I wish we'd had five years ago — it's short, it's simple, and it's absolutely brutal to bring up with your parents. Do it anyway.

    My hope is this nudges you to have some of these talks now, while everybody's healthy and nobody's crying in a garage. Been through it yourself? I'd love to hear what you'd do differently.

    And if this is your first time here — we normally talk pentesting, blue teaming, certs and security careers over at 7MinSec.com. Come hang out at 7MinSec.club, our free Substack where TuesdayTOOLSday is getting back to fundamentals, and check out 7MinSec.wiki, where every article is getting paired up with a video.

    Have a great week,
    Brian

    Show More Show Less
    30 mins
  • 7MS #735: Baby's First Cloudflare Tunnel
    Aug 14 2026

    Hey friends! Today's episode has a new-to-me toy up front and some podcast housekeeping on the back half – all recorded with a raging case of the anxious parent giggidies, because my son Atticus had a big audition and I was minutes away from finding out whether we were doing tears of joy or tears of sadness.

    Baby's first Cloudflare Tunnel

    Not a sponsor, not an ad – just a thing I'd heard about for years and finally had a reason to use. Here's what we get into:

    • The problem that sent me down this road: I wanted push-button status pages for clients that pull from one source of truth – not just "is the box up," but actual narrative on where a project is at
    • Why the off-the-shelf status page tools weren't the right shape, and why "just stick it on a web server" was a non-starter for a scraper-and-AI-slop-crawler internet
    • The auth paths I tried and abandoned before Cloudflare Tunnels entered the chat
    • How Cloudflare Access one-time PINs put a guard out front – and what happens when fartface@meowmix.com tries to log in
    • My Chick-fil-A-order-tracker dreams for multi-phase assessments, and why I think it could kill a bunch of clogged-up email threads
    • Why the code isn't public yet (it's public-facing infrastructure I haven't hardened, and I've got hunches about where the holes are) – but reach out if you want to build something similar and I'm happy to share privately
    • Where tunnels fit generally: when something genuinely needs to be reachable, but you'd rather not hand it a public IP or expose RDP to the whole internet. It doesn't replace Twingate for me, but it fills a different slot nicely
    • Bonus tangent: why Claude has become my long-drive road companion, and five enlightening minutes I spent learning how water towers work

    Housekeeping: a refreshed jingle and a brand new bumper

    • A quick history of the 7MS jingle – from just me and an acoustic guitar, to a Fiverr band, to now
    • Why "security is hard, so let's assume we're probably going to get pwned by noon" has aged frighteningly well (see also: AI agents teaching each other to find previously unknown vulns)
    • Meet Jacob Davis, the guitar teacher the algorithm dropped in my lap, who recorded a gorgeous all-strings arrangement of the jingle and about 45 seconds of fingerpicking diddly goodness for our new outro bumper. Stick around to the end and give it a listen – and if you're in the market for internet guitar lessons, he rules

    And over on 7MinSec.club this week

    • I show off VoiceInk, a private, local voice dictation utility for Mac that Paul the Unstoppable turned me on to. Lifetime license, no subscription, and it does a great job on live dictation or audio files you feed it. Catch the TuesdayTOOLSday over at 7MinSec.club

    Thanks for listening – to the security stuff, the tangents, or both. Come find us at 7MinSec.com, subscribe (free or paid) over at 7MinSec.club, and dig through our notes at 7MinSec.wiki. God bless you, and have a great week!

    Show More Show Less
    25 mins
  • 7MS #734: Insight Recon
    Aug 7 2026
    Hey friends! Today's episode is a two-parter: some security stuff up front, and then a big ol' personal celebration on the back half. If you're strictly here for the security bits, I love you and you're free to bail after the first half. If you're here for both, God bless you. Part 1: Kicking the tires on Insight Recon What it is: Insight Recon is an Active Directory security assessment tool out of Heath Adams' new venture, Breach Point. I signed up for early access a while back, finally got a login, and took it for a spin this week in my GOAD lab. Not a sponsor, not an ad — just a tool I was curious about.Watch it in action: I covered the install, a couple of hiccups I hit, and some of the report output in this week's TuesdayTOOLSday video over at 7MinSec.club.The setup: Log into the portal, grab the installer, run it on a domain-joined box, then pick whether you want to scan as your current user or specify creds. Say go, wait a few minutes, and your report card shows up on the dashboard.My two nitpicks (and they're mine, not necessarily yours): The download does a full-blown install with an install footprint, and the raw scan data gets shipped back up to Insight Recon so you can view your report. I can't help but compare everything in this space to PingCastle, where you unzip, run the EXE, and your HTML report is sitting right there on the C drive — nothing leaves the building. As someone who tries to be a good data janitor and nuke assessment data after reports go out, cloud storage is just one more place I've got to remember to go scrub.What I really liked: The remediation guidance is legit. I clicked into a few of the critical findings — some ESC/ADCS stuff especially — and it walked me through exactly what to change, why an attacker cares, how to verify the fix afterward, and where to go read more. There's also a "quick wins" view that pares the big list down to the biggest security impact for the least effort. The dashboard and the slide-out detail panes are genuinely pleasant to use.Why this matters even for offense-only folks: We're mostly on the offensive side with a little blue team consulting — we don't do hands-to-keyboard remediation. But I think you become a better pentester when you can speak confidently at delivery time about not just what to fix, but the gotchas that might bite them along the way.Pricing: On the podcast I guessed "a few thousand a year" and admitted that number may have come straight out of my bum cheeks. Turns out I wasn't too far off — there's a free tier to start, and paid runs $3,000/year with founder pricing at $1,500/year locked in for the first 25 customers. See the pricing page for the current details.Verdict so far: A promising first dance. I want to give it a proper workout — run it side by side with PingCastle on a couple of real assessments and see if either one has blind spots the other covers. More on that in a future episode. Part 2: Why I've got the giggidies My son Cam graduated paramedic school! As of tonight he has everything signed off to go take the gargantuan national test. I'm not going to pretend I got through recording this without getting a little watery-eyed.The journey: Senior year of high school, nothing career-wise floated his boat — there were subjects he tolerated and subjects he hated, and that was about it. Then a conversation with a family friend who's a paramedic lit a fire in his belly, and he's been running at it ever since: EMT coursework in high school, then straight into the paramedic program.How he did it: He wrestles with ADHD, so he had to figure out how to hack his own brain to get through a mountain of material. Come home from five or six hours of class, eat dinner, then hit the books again and re-take his own notes. Then he'd sit down with my wife or me and do an Ace Ventura-style verbal dump of everything he'd learned that day — and any time he caught himself glitching on something, he'd write it down, keep going, then go back and shore it up. Every single night.The Mr. Miyagi moment: My wife has been a nurse for 20+ years, and about six months ago she had to tell him she couldn't help anymore because he'd surpassed her in certain areas of healthcare.Yes, AI made a cameo: The night before his final scenario testing, he and I sat down and had Claude generate random practice scenarios so I could prompt him and just watch him talk for two minutes straight about airway management, medication dosing, all of it.The cliffhanger: Four-ish hours of individual scenario testing, an hour-and-a-half drive to the ceremony, and no word either way on if he passed his tests. I hit the front door of the building not knowing whether I was walking into smiles or tears — and right as my hand hit the door handle, a text came in with a giant happy face: I passed. Somebody must have been cutting onions in that parking lot.His people: Cam's the youngest of the bunch — most of his classmates had ...
    Show More Show Less
    32 mins
adbl_web_anon_alc_button_suppression_t1
No reviews yet