Alle afleveringen van CISO Series Podcast – pagina 6 van 9

Chances Are We'll Be Attacked the Day Before Your Vacation

16 november 2021 · 37 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

Do the cybercriminals know my vacation schedule? If they're already in our network, they probably do. Why don't they share their vacation schedule with me. That way we can all enjoy our time off.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest is Patti Titus (@rusecur), CISO, Markel.

Thanks to our podcast sponsor, Sotero

Today's compliance requirements require a security mindset that focuses on the data itself. We can't truly protect sensitive data when our solutions only provide protection at the network, application or database level. The good news is that you can now protect the actual data itself. Click to learn how.

In this episode:

What role is the quickest to a CISO role?

How can we best correlate security behavior to business actions?

Are attacks more likely on Fridays, just before a long weekend or vacation?

Which breaches this year caused a shift in focus of your security program?

Did You Get My Last Email? This One Has a Joke In It.

9 november 2021 · 50 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

At one point a sales representative will get so desperate trying to get a reply from a prospect that they'll resort to some tepid attempt a humor. We've all seen the email that is trying to understand why we're not replying. And the salesperson tries to make it easy for the recipient to respond by just pressing a single digit. 1: You're too busy, 2: You didn't see my email, 3: You really wanted to respond but you're stuck in a well.

This week's episode of CISO/Security Vendor Relationship Podcast was recorded in front of a live audience at the SF-ISACA conference in San Francisco. It features me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest is my other co-host Andy Ellis (@csoandy), operating partner, YL Ventures.

Huge thanks to our podcast sponsors, Code42, Sotero, and Constella Intelligence

As organizations gradually and cautiously move out of adapt-or-die mode into the post-pandemic era, we can expect a second phase of digital transformation: resilience building. This presents an opportunity for security teams. An opportunity to re-imagine data security. More from Code42.

Today's compliance requirements require a security mindset that focuses on the data itself. We can't truly protect sensitive data when our solutions only provide protection at the network, application or database level. The good news is that you can now protect the actual data itself. Click to learn how.

Threat actors target key employees due to their privileged access to sensitive data which can lead to credential theft, ATO, & ransomware attacks. Find out if your key employees and company have been exposed – without any obligation. More from Constella Intelligence.

In this episode:

How do you go about making a business case for further investment in cyber security initiatives?

Is it possible to get people to get security people change their behaviors?

Using humor in cold sales. Does it ev…

Hackers of the World Unite… When We Can Agree on a Time

2 november 2021 · 38 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

"Look, you wanna be elite? You have to do a righteous hack."

This entire episode we pay tribute to the movie "Hackers" with quotes all throughout the programming. This episode is hosted by me, David Spark (@dspark), producer of CISO Series, and my guest co-host Roland Cloutier (@CSORoland), CISO, TikTok. Joining us in this discussion is Steve Tran (@steveishacking), CISO, MGM Studios.

Thanks to our podcast sponsor, Code42

In this episode:

Is it time to start thinking about protecting data differently?

What is the biggest scam in tech that is deemed acceptable?

Why is the convergence of security between physical and digital still not happening?

Which part of your role is science vs art?

Is Our CISO Doing a Good Job? Our CISO Doesn't Even Know.

26 oktober 2021 · 35 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

It's extremely hard to tell if a cybersecurity leader is doing a good job. In fact, it's tough for even them to know. Our best bet is watching for an improvement in the cybersecurity program over time.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest is Mark Wojtasiak (@markwojtasiak), vice president, research & strategy, Code42 and co-author of "Inside Jobs."

Thanks to this week's podcast sponsor, Code42

As organizations gradually and cautiously move out of adapt out of adapt-or-die mode into the post-pandemic era, we can expect a second phase of digital transformation: resilience building. This presents an opportunity for security teams. An opportunity to re-imagine data security. More from Code42.

In this episode:

What is your business's biggest frustration when managing cybersecurity?

Aaaand...what is your biggest frustration when managing cybersecurity?

How do you know when a Security Leader (including yourself) is doing a good job?

Would it help if Security hired a marketing manager?

BONUS Episode: Innovation Spotlight

22 oktober 2021 · 41 min

Afspelen

Here's an awesome bonus episode of CISO/Security Vendor Relationship Podcast featured as the closing event at Evanta's Global CISO Virtual Executive Summit. Lees meer

Here's what went down. The day before our recording, three representatives presented their unique and innovative security solutions to a panel of CISOs and the virtual audience in attendance.

The next day, everyone came back to offer up a quick elevator pitch and to be grilled by the CISOs. That's exactly what you get to hear on this bonus episode of CISO/Security Vendor Relationship Podcast.

Thanks to all our sponsors for this bonus episode of the podcast

Kasada

Axis Security

Ordr

Ten Eleven Ventures

We Want to Hire Honest People Who Think Like Criminals

19 oktober 2021 · 36 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

What game should we play where we can trust you to behave fairly, but at the same time see how you could take advantage of us?

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest is Deneen DiFiore (@deneendifiore), CISO, United Airlines.

Thanks to our podcast sponsor, Code42

As organizations gradually and cautiously move out of adapt out of adapt-or-die mode into the post-pandemic era, we can expect a second phase of digital transformation: resilience building. This presents an opportunity for security teams. An opportunity to re-imagine data security. More from Code42.

In this episode:

Does becoming a business-minded security person take time?

What does a qualified, entry level candidate have to do to get noticed?

Without clear ROI, how does a CISO justify their budget?

What game taught you the most about thinking like a hacker?

A Quick Way to Tell Which Vendors You Should Avoid

12 oktober 2021 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

Do you really need hundreds of questions to know if you want to work with a vendor? Won't just two or three well-pointed questions really give you a good idea?

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Our guest is Nick Selby (@fuzztech), CSO, Paxos Trust Company and co-host of Tech Debt Burndown podcast.

Thanks to our podcast sponsor, Kenna Security

In this episode:

How do you suss out security vendors to make sure they're not a risk?

How do you battle a typosquatter?

What types of preparations do you have in place to know you're well prepared for an incident?

How should CISOs and CIOs share cybersecurity ownership?

The Ostrich Approach To Vulnerability Management

5 oktober 2021 · 35 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

OK, you showed us our vulnerability. But we really don't want to fix it now. Could we just pay you off to keep quiet, and to buy us some more time to deal with this in a "not so timely" manner?

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest is Sameer Sait (@sameersait), CISO, Amazon - Whole Foods.

Thanks to our podcast sponsor, Code42

As organizations gradually and cautiously move out of adapt out of adapt-or-die mode into the post-pandemic era, we can expect a second phase of digital transformation: resilience building. This presents an opportunity for security teams. An opportunity to re-imagine data security. More from Code42.

In this episode:

What if software developers used academic citations for code acquired from outside sources?

What is a reported security vulnerability doesn't get fixed? Where do you go next?

What if a 3rd party app developer needs access to a file/print share over the internet?

What if you receive a pitch that makes a grandiose statement like "no false positives?" Follow-up or hard pass?

Sorry, We're Full. We Can't Take Any More Market Segments

28 september 2021 · 37 min

Afspelen

No, please not another acronym. I can't take another education cycle on another product segment. Oh, I'm sure Gartner is launching it. And I'm sure they'll make yet another Magic Quadrant to tell us which companies are in this new market segment. And we're going to have to buy this report so we understand this new category so we can create yet another line item on our budget sheet. Lees meer

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest is Ed Bellis (@ebellis), co-founder and CTO, Kenna Security (now a part of Cisco).

Thanks to our podcast sponsor, Kenna Security

In this episode:

How do you develop unbiased knowledge about a new technology?

Do you have advice on how to prepare for a SOC interview?

Vulnerability management: what have we heard enough of?

Do your parents know what you do for a living?

What's the ROI of Nothing Happening?

21 september 2021 · 37 min

Afspelen

You don't want anything to happen, but you also want security to somehow to calculate ROI. Maybe the ROI could be calculated from actual sales that security allowed to actually happen. Lees meer

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Our sponsored guest is Ryan Gurney, CISO-in-residence, YL Ventures.

Thanks to our sponsor, YL Ventures

YL Ventures, a global VC firm, manages over $300 million and exclusively invests in early-stage Israeli cybersecurity startups. YL Ventures accelerates the evolution of its portfolio companies via strategic advice and operational execution, leveraging a network of CISOs and industry veterans from Fortune 100 and high-growth companies.

In this episode:

What happens when Application Surface Management (ASM) vendors are purchased as Security assets?

What do you do when your company wants to use a really insecure SaaS product?

Does a startup need a CISO, or just a CISO-in-residence?

Is there a better sign other than "nothing happened" that indicates you did a good job in cybersecurity today?"

Could We Speak To Your CISO To Confirm He Received the Cupcakes?

14 september 2021 · 41 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

It's imperative we speak to him. We want to make sure they landed safely. And if he has some available time, maybe we can show him our slide deck.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Our guest is Branden Newman, svp, CISO, MGM Resorts.

Thanks to our podcast sponsor, Grip Security

Ask yourself – do I know what SaaS my company is using? How do users access them? What data is uploaded and downloaded? Enterprises today are using hundreds and thousands of different SaaS, and have lost control over it.

Grip Security sees and secures every SaaS application. With simple deployment, you can have immediate visibility to the entire SaaS portfolio, and automated access and data governance at scale. This is the only way you could fight the SaaS Sprawl.

In this episode:

How do security vendors communicate their uniqueness and product quality?

If you were to start a data security company - what gap would you fill?

What's the pushiest sales tactic you've seen in InfoSec?

Assessing vendor pitches on email security or human layer security

Make Your Friends Jealous with Our Hand-Crafted Passwords

7 september 2021 · 43 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

I know your friends say they use excellent passwords, but they don't take the time and care we put into choosing the right combination of letters, numbers, and special characters that's unique to your personality. Once your friends and the dark web have a chance to see them, they'll want to emulate you by using your password over and over again.

This week's CISO/Security Vendor Relationship Podcast was actually recorded in front of a small live audience at The Passwordless Summit in Newport, Rhode Island. The event was sponsored by HYPR, our sponsor for this episode as well. Joining me and my co-host, Andy Ellis (@csoandy), operating partner, YL Ventures, was our sponsored guest, Brian Heemsoth (@bheemsoth), head of cyber defense and monitoring, Wells Fargo.

Thanks to our podcast sponsor, HYPR

HYPR is the leader in Passwordless Multi-factor Authentication.
We protect workforce and customer identities with the highest level of assurance while enhancing the end user's experience. HYPR shifts the economics of attack to the enterprise's favor by replacing password-based MFA with Passwordless MFA.
Welcome to The Passwordless Company®. It's time to reimagine Identity Access Assurance.
Learn More »

In this episode:

Ways to make a good impression about the quality of your security

How's passwordless access working for you?

When an EULA says no to reviewing the product

What does a good SOC look like to you?

Are You Asking "How Secure Are We?" or "How Insecure Am I?"

31 augustus 2021 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

We've heard the question "How secure are we?" many times, and we know what it really means.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Our guest is Kevin Morrison, CISO, Alaska Air.

Thanks to our podcast sponsor, Enso

Enso, an Application Security Posture Management platform, helps security teams scale and gain control over their AppSec programs. Enso discovers application inventory, ownership and risk to easily build and enforce security policies and transform AppSec into an automated, systematic discipline.

In this episode:

Red flag-level bad security: run away or offer to help?

How necessary is it to know patterns of where and how criminals are going to attack?

How to manage the risk of onboarding entry level cybersecurity personnel who lack prior job experience?

How do you answer the question, "Are we secure?"

Tips to Finding an Incompetent Overpriced Cybersecurity Consultant

24 augustus 2021 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

What questions should we be asking of a consultant's referrals to see if they're really worth the money they're trying to overcharge us?

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest is Ira Winkler (@irawinkler), CISO, Skyline Technology Solutions.

Thanks to our podcast sponsor, Varonis

Varonis will help you get meaningful data security results faster than you thought possible. Protect sensitive data, detect sophisticated threats and streamline privacy and compliance. Visit varonis.com/risk for a demo of Varonis' leading data security platform.

In this episode:

Fujifilm refused to pay ransomware demand, restored from backup. Be like Fujifilm.

What to do with people who ask for your password and sign-on – and those who comply

Best techniques for interviewing cybersecurity consultant candidates

The importance of securing inter-organization Slack and Teams channels

We Shame Others Because We're So Right About Everything

17 augustus 2021 · 36 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

You think it's easy carrying around the burden of being so perfect all the time? It's tough to carry that responsibility to tell others what they need to do.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Our guest is Ed Contreras (@cisoedwardc), CISO, Frost Bank.

Thanks to our podcast sponsor, Varonis

Varonis will help you get meaningful data security results faster than you thought possible. Protect sensitive data, detect sophisticated threats and streamline privacy and compliance. Visit varonis.com/risk for a demo of Varonis' leading data security platform.

Does a quality tech stack help with recruitment and retention of talent?

Should security features be free?

And should those who charge be shamed?

Failing phishing tests - is there a limit to how many?

Will You Accept "My Bad" As Our Breach Response?

10 augustus 2021 · 33 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

We know we've got to say something about this breach, but geez, the details are really sordid and it would just be easier if we could just wrap it up with one giant "oops." You cool with that?

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest is Matt Radolec, senior director, incident response and cloud operations, Varonis.

Thanks to our podcast sponsor, Varonis

Varonis will help you get meaningful data security results faster than you thought possible. Protect sensitive data, detect sophisticated threats and streamline privacy and compliance. Visit varonis.com/risk for a demo of Varonis' leading data security platform.

In this episode:

How have insider threats morphed since the onset of Covid?

Should paying ransomware be illegal?

What goes into a good post-breach public incident response?

Should ransomware focus more on backups?

I'll Show You My Risk Profile If You Show Me Yours

29 juli 2021 · 35 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

Managing my own risk is tough enough, but now I have to worry about my partners' risk and their partners' risk? I don't even know what's easier to manage: the risk profile of all my third parties or all the exclusions I've got to open up to let third parties into my system.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest is Bruce Potter (@gdead), CISO, Expel.

Thanks to our podcast sponsor, Expel

Expel offers companies of all shapes and sizes the capabilities of a modern Security Operations Center without the cost and headache of managing one.

In this episode:

What's easier to manage, 3rd party risk profiles or exclusions?

Do you need a Git repository to apply for a job? What else?

What's in your happy-grab-bag for hybrid work environments?

Is there anything new to say about ransomware strategy?

How Much Charisma Do I Need to Push My Team to the Edge?

27 juli 2021 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

If I'm going to be riding my team really hard, how much charisma will I need to keep the team frightened so they stay motivated, yet don't want to leave?

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest is Jason Fruge (@jasonfruge), CISO, Rent-a-Center.

Thanks to our podcast sponsor, Expel

Expel offers companies of all shapes and sizes the capabilities of a modern Security Operations Center without the cost and headache of managing one.

In this episode

CISO's second job: applying lessons learned from the first one

Experts weigh in on what to do when a breach drops malware on you

How to motivate staff to push themselves beyond initial expectations?

What level of autonomy do you give your staff to make purchase decisions?

How Would You Like Your Cloud Misconfigured?

20 juli 2021 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

Great, you just purchased the cloud. Are you a little confused as to what you're going to do with it? Not a problem. Let's get you set up right with a world class misconfiguration. That should leave you open to all kinds of breaches.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest is Johnathan Keith, CISO, Viacom/CBS Streaming.

Thanks to our podcast sponsor, AppOmni

AppOmni is building the future of SaaS security. We empower our users to enforce security standards across their SaaS applications, and enable them to remediate in confidence knowing they're fixing the most important SaaS security issues first. Contact us at www.appomni.com to find out who - and what - has access to your SaaS data.

Why do we hear so many stories about poor & misconfigured cloud services?

The benefits of Infrastructure as Code (IaC)

What makes a vendor meeting worth your time?

What's the best way to learn about a company's culture in a job interview?

It's Only a Matter of Time Before We Lose Your Data

13 juli 2021 · 32 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

We're trying really hard to keep our customers' data safe, but we all know given the number of attacks happening, our number will eventually come up, and we'll lose your data just like every other organization you trusted.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest is Sandy Dunn (@sub0girl), CISO, Blue Cross of Idaho.

Thanks to our podcast sponsor, Expel

Expel offers companies of all shapes and sizes the capabilities of a modern Security Operations Center without the cost and headache of managing one.

Dissecting Allen Gwynn's "one strike" opinion piece

Transitioning cybersec into a mindset for all employees

Shifting the risk: buying cyberinsurance instead of tools

What's the proper way to behave during a breach?

His Credentials Say "Yes" But His Behavior Says "No Way"

6 juli 2021 · 36 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

As good as our virtual bouncers are, they often let in people with what seems to be a valid ID, and then once they're in our nightclub they cause a disruption and we have to kick them out.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest is Sandy Wenzel (@malwaremama), cybersecurity transformation engineer, VMware.

Sandy also recommends participating in Pro's vs. Joe's CTF.

Thanks to our podcast sponsor, VMware

In this episode:

How we have become more agile (and how we define agile)

Five skills every SOC analyst needs (and how to build them)

Lateral movement by threat actors (what have we heard enough of)

What are some good assignments to give a cybersecurity intern (and are there better ones?)

We're Experts at Finding Everything You're Doing Wrong

29 juni 2021 · 33 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

We're a brand new consultancy and we promise if you just let us poke around your network, we'll find something wrong. Because everyone has something wrong in their network.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest is Phil Huggins (@oracuk), CISO, NHS Test & Trace, Department of Health and Social Care.

Thanks to our podcast sponsor, VMware

In this episode:

Prioritizing the security challenges around risk and compliance

What to consider before starting your own security consulting business

The most valuable things you should learn from peers in your network or community

Hey Old Man, Go Rotate Your Own Passwords

22 juni 2021 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

If you're happy with your best practice of rotating passwords, that's great for you. Just don't lay your old-timey "rules for better security" on me boomer.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest is Robb Reck (@robbreck), CISO on sabbatical and co-founder Colorado=Security, a podcast and Slack community.

Thanks to our podcast sponsor, VMware

In this episode:

Who is supposed to put "security" into the shifted left SDLC?

What's the scarcest resource to a CISO? Is it headcount or money?

What's the hardest part about being a CISO?

How to choose the "best" best practices.

How CISOs Make It Worse for Other CISOs

15 juni 2021 · 39 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/how-cisos-make-it-worse-for-other-cisos/

Are CISOs inappropriately putting pressure on themselves and is that hurting the rep of all CISOs as a result?

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest is Andy Ellis (@csoandy), operating partner, YL Ventures.

Thanks to our podcast sponsor, Orca Security

Orca Security provides instant-on security and compliance for AWS, Azure, and GCP － without the gaps in coverage, alert fatigue, and operational costs of agents or sidecars. Orca detects and prioritizes risk in minutes ﹣ not months ﹣ and is trusted by global innovators, including Databricks, Lemonade, Gannett, and Robinhood.

In this episode:

Is the hiring process for CISOs broken?

Why CISOs aren't willing to share samples of their risk assessments

Working with a vCISO through an MSSP

What are the biggest misconceptions cybersecurity people have about CISOs?

Excuse Me, What Bribes Do You Accept?

8 juni 2021 · 32 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/excuse-me-what-bribes-do-you-accept/

The security vendor/practitioner sales cycle would go a lot faster and smoother if CISOs would just take an "incentive" for a meeting. Just tell me what "incentive" you would like. I'm sure it'll cost me a lot less than what I'm spending on marketing and sales.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest is Allison Miller (@selenakyle), CISO, reddit. Allison is available on reddit at /u/UndrgrndCartographer.

Thanks to our podcast sponsor, Living Security

Why We're Breaking Security Awareness (And You Should Too)
Attend This Free, Virtual Conference From Your Home, Office, Or Even Your Couch. Living Security is breaking the mold of security awareness to wage war on the human risk factor with evolved strategies for the way we live, work, and play today.
Join cybersecurity industry thought leaders for fresh, modern perspectives designed to help you change behaviors and reduce your organization's risk in a world where life happens online.
This year's sessions will cover:

Human Risk Management

Social Engineering

DEI In Cybersecurity

Enterprise Security Awareness

Remote Working Security

Ransomware

In this episode:

Relying on the end-user to make an app secure is, in essence, shipping insecure software

It's official: mandatory password changes are no longer in vogue

What incentives would you accept to take a meeting with a vendor

Holy Crap! We've Been Doing This for Three Years!

1 juni 2021 · 33 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/holy-crap-weve-been-doing-this-for-three-years/

On this day three years ago, Mike Johnson and I released the first episode of CISO Series' CISO/Security Vendor Relationship Podcast.

Our primary goal was to talk about the strained yet much needed relationship between security practitioners and vendors. With the help of our guest Dan Walsh, CISO, VillageMD and plenty of contributors we look back and ask ourselves, "What's changed and has anything improved?"

If you're interested in hearing the full story of how CISO Series started, listen to this episode of Defense in Depth with Mike Johnson and Allan Alford where we walk through the origins of what has become a rather sizable media network.

Thanks to our podcast sponsor, Sonatype

With security concerns around software supply chains ushered to center stage in recent months, organizations around the world are turning to Sonatype as trusted advisors. The company's Nexus platform offers the only full-spectrum control of the cloud-native software development lifecycle including third-party open source code, first-party source code, infrastructure as code, and containerized code.

In this episode:

What listeners get out of the show & what has changed in the industry

How communication has changed among CISOs in three years

Is there more compassion for vendors now?

How is the vendor landscape changing?

Something Stinks In Here. I Think It's Your Code.

25 mei 2021 · 36 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/something-stinks-in-here-i-think-it's-your-code/

The problem isn't our users, it's you and your past due code. Something happened. It's either been tainted or expired, but whatever it is, it smells and you need to clean it up.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest this week is Brian Fox (@brian_fox), co-founder and CTO, Sonatype.

Thanks to our podcast sponsor, Sonatype

With security concerns around software supply chains ushered to center stage in recent months, organizations around the world are turning to Sonatype as trusted advisors. The company's Nexus platform offers the only full-spectrum control of the cloud-native software development lifecycle including third-party open source code, first-party source code, infrastructure as code, and containerized code.

In this episode:

How do you know if your DevSecOps effort is going to fail?

How does an analyst justify their existence?

Managing malicious intruders in code libraries

Managing cybersecurity hygiene in the software chain

Our Top Ten List of Vendors That Aren't You

18 mei 2021 · 32 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/our-top-ten-list-of-vendors-that-arent-you/

You look at a top ten list is to see if you made the list. Don't bother. You're not on it.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Nancy Hunter, vp, CISO, Federal Reserve Bank of Philadelphia.

Thanks to our podcast sponsor, Code42

Redefine data security standards for the hybrid workforce. Check out Code42.

In this episode:

Threat tracking: what's better? Your SOC's data or reading industry trends?

Finding good security people -what's better?: existing skills/experience, or a hunger to learn?

Listing the things we like about security vendors

Diversity hiring still has some challenges

Do We Have to Let the CISO Sit With Us?

7 mei 2021 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/do-we-have-to-let-the-ciso-sit-with-us/

I guess because it's a pandemic, and we really need them, just this one time, we'll let the CISO hang out at the cool kids' table.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest this week is Jadee Hanson (@jadeehanson), CISO, Code42.

Thanks to our podcast sponsor, Code42

Redefine data security standards for the hybrid workforce. Check out Code42.

In this episode:

Apparently, CIOs have become really hot commodities within the organization

Do compliance checkboxes to third party surveys provide any security for the supply chain?

Insider risk should look more at mistakes as well as intentional acts

The real value of vendor white papers

Why Commute When You Can Stay Home and Be Overworked?

4 mei 2021 · 35 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/why-commute-when-you-can-stay-home-and-be-overworked/

Work from home seemed ideal until you realized you were working at all hours with people all over the world. It would actually be a nice respite to have to commute and leave work at a reasonable hour.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Adam Glick, CISO, Rocket Software.

Thanks to our podcast sponsor, Code42

Redefine data security standards for the hybrid workforce. Check out Code42.

In this episode:

Work-from-home – the joys and the sorrows

What do we want the board and C-Suite to know about cybersecurity?

Are you a cybersecurity or infosec hiring manager? What kind of interview questions do you ask?

CISOs working with young cybersecurity entrepreneurs

Pushing This to the Top Of Your Inbox So You Can Delete It Again

27 april 2021 · 35 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/pushing-this-to-the-top-of-your-inbox-so-you-can-delete-it-again/

We're following up on our previous email because we love to engage in self-defeat. We assume you don't want to hear from me again, but just to make sure, I've delivered another email for you to delete.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Rinki Sethi (@rinkisethi), CISO, Twitter.

Thanks to our podcast sponsor, Sonatype

With security concerns around software supply chains ushered to center stage in recent months, organizations around the world are turning to Sonatype as trusted advisors. The company's Nexus platform offers the only full-spectrum control of the cloud-native software development lifecycle including third-party open source code, first-party source code, infrastructure as code, and containerized code.

In this episode

It takes a while to hire an awesome cybersecurity team. It takes even more work to keep them.

Breaches are bad, but handling them badly might be worse

The unique aspects of work from anywhere security that take time to discover

More of "what not to do" as a vendor pitching a cybersec prospect

OK, I Get It. You're All Special Snowflakes.

20 april 2021 · 39 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/ok-i-get-it-youre-all-special-snowflakes/

This department manager thinks their data is the most important. But then this department manager thinks their data is the most important. Can there really be so many crown jewels in your company that are all equally important? How's a CISO supposed to prioritize?

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Melody Hildebrandt (@mhil1), executive vp, consumer products and engineering, and CISO, Fox

Thanks to our podcast sponsor, Herjavec Group

Herjavec Group excels in complex, multi-technology environments and keeps enterprise organizations secure with best of breed products and comprehensive service offerings. With 5 global Security Operations Centers, emerging technology partners, and a dedicated team of security specialists, we are well-positioned to be your organization's trusted advisor in cybersecurity. Let's connect!

On this week's episode

Hey, you're a CISO, what's your take?

Recently, we did a Friday video chat on "Hacking the Crown Jewels" where we talked about what's really important, where it resides, and who's accessing it and when. One of the questions that came up from consultant Ian Poynter was how do you handle the conflicts from the different department leaders as to what the crown jewels are? And Jakub Kaluzny of SecuRing asked, "What's harder, identifying your crown jewels, or protecting them?"

Can you change Mike's mind?

Our guest, Melody Hildebrandt mentioned that as of recently she was in a pro-vendor mood Only three months into the year she has taken more new vendor meetings than in all of 2020. What changed? And can she convince Mike to do the same?

"What's Worse?!"

As always, this will be a surprise on the show. And no one will like the options.

If you haven't made this mistake, you're not in security

Even if you've configure…

What to Expect When You're Expecting a Network Breach

13 april 2021 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/what-to-expect-when-youre-expecting-a-network-breach/

Are you expecting a little intrusion into your network any day now? You better be prepared. Are there some vulnerabilities you should have managed, but didn't? Don't worry, first time security professionals are always scared about their first incident.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest this week is Scott Kuffer, co-founder and COO, Nucleus Security

Thanks to our podcast sponsor, Nucleus Security

Nucleus unifies your existing security stack, integrating with over 70 scanners and external tools, creating a centralized hub to control the chaos of vulnerability analysis, triage, and remediation. Ready to make the tedious VM process simple through smart automation and workflow optimization? See for yourself at https://nucleussec.com/demo

On this week's episode

There's got to be a better way to handle this

We constantly hear security leaders talk about "people, process, and technology". Overwhelmingly, most security vendors are selling technology, then after a very steep drop there is the sale to managing people, and then "process" feels like a neglected stepchild. Let's talk about one process change made in the past year that had a significant impact on security posture? AND what is the "process" in security that needs the most help? Is there an opportunity in this area for security vendors or this just a combination of project management and increased automation?

What do you think of this vendor marketing tactic

Are security vendors eating their own dog food? The next time a security vendor pitches you, Chris Roberts of Hillbilly Hit Squad said on LinkedIn, "Ask them if they are using their own systems to protect themselves OR if they're relying on someone else's technology to protect their arses." An excellent question and HOW a vendor an…

We Recommend a "Know the Right People" Certification

6 april 2021 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/we-recommend-a-know-the-right-people-certification/

There are so many fantastic certifications out there for security professionals. But we've found the one certification that will really help you land the right job really quickly, is to provide proof that you know some people at our company who can vouch for you. Remember, we are a business that operates on trust, not giving people their first chances in cybersecurity.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Jesse Whaley, CISO, Amtrak

Thanks to our podcast sponsor, Adaptive Shield

Adaptive Shield ensures companies gain control over their SaaS app security and prevents the misconfigurations and vulnerabilities that could lead to a leak or breach. Adaptive Shield connects to any app, continuously monitors all configurations, provides a complete picture of the company's SaaS estate, and enables quick remediation of any potential threats.

In this week's episode

Why is everybody talking about this now?

Should cybersecurity professionals fight back rather than block and tackle? former US government cyber security chief Chris Krebs, has called on law enforcement and others to fight back against ransomware attackers. Krebs, suggested posting private information of the hackers, with malicious intent, AKA doxxing. "Hacking back" is dangerous as it's hard to determine the attacker, and you're essentially taking the law into your own hands, but Chris Krebs is recommending this, seeing that ransomware is the biggest threat.

Dan Lohrmann of Security Mentor shared this article from the Financial Times and it drove a lot of debate. We've heard this before, but from someone like Chris Krebs, that's astonishing. What level of fighting back should people be comfortable with?

Are we having communication issues?

"I push back [on vendors] because I want depth a…

My Backup Plan Is Hoping My Cloud Provider Has a Backup Plan

30 maart 2021 · 38 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/my-backup-plan-is-hoping-my-cloud-provider-has-a-backup-plan/

I think maybe I should check to see if we paid for cloud backup protection. Or maybe, we're doing it. Who knows?

This episode is hosted by me, David Spark (@dspark), producer of CISO Series, and Mike Johnson. Our guest this week is Ty Sbano (@tysbano), chief security and trust officer, Sisense

Thanks to our podcast sponsor, Adaptive Shield

Adaptive Shield ensures companies gain control over their SaaS app security and prevents the misconfigurations and vulnerabilities that could lead to a leak or breach. Adaptive Shield connects to any app, continuously monitors all configurations, provides a complete picture of the company's SaaS estate, and enables quick remediation of any potential threats.

On this week's episode

Why is everybody talking about this now?

Is your cloud service provider backing up your data, or should you be doing that? Many users of OVHcloud realized they should have been doing it because they didn't realize what they had bought. OVH suffered a fire that destroyed one of its data centers making some of the customer data unrecoverable. They had backup of some services, but no backups of other data. As of now, OVH is backing up all customer data for free, but this speaks to a big problem with trusting cloud providers, noted Enrico Signoretti of GigaOm in a post on LinkedIn. Did you pay for backups? How are they being provided? Where physically are they? And how often do you test restoring? Everyone knows they should do this, but how often is it actually being done?

Someone has a question on the AskNetSec subreddit

On the AskNetSec subreddit, the question was asked, "What's the advantage of reporting bugs to official sources over brokers?" Some really good pro and con discussions of both ranged from brokers usually pay more, to going straight to the source seems "the right thing to do." But t…

Patches? Yes, We Need Stinkin' Patches!

23 maart 2021 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/patches-yes-we-need-stinkin-patches/

There was a time we could trust a patch, but now our adversaries are actually looking at the patches to find even more vulnerabilities. And we keep patching those as well. Our patches' patches need patches. When does it stop?!

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest this week is Travis Hoyt (@travisehoyt), managing director, exec cybersecurity technology, TIAA

Thanks to our podcast sponsor, Adaptive Shield

Adaptive Shield ensures companies gain control over their SaaS app security and prevents the misconfigurations and vulnerabilities that could lead to a leak or breach. Adaptive Shield connects to any app, continuously monitors all configurations, provides a complete picture of the company's SaaS estate, and enables quick remediation of any potential threats.

On this week's episode

What's the best way to handle this

The vulnerability landscape is changing, according to a new report from Rapid7. One issue, as Rob Lemos of DarkReading reports, is that you can't necessarily trust patches. They're often incomplete, and attackers look at existing patches as an opportunity to find more flaws, which they do. And the threats come from different angles: they're widespread, targeted, often using a zero-day, and there are other vulnerabilities that are impending threats. It seems that the portion of the threats you know about and can defend against is shrinking, and you're battling more of the unknown. Have you seen similar, and if so how has your security program shifted as a result?

That's something I would like to avoid

The NSA recently provided guidance on creating a Zero Trust security model. In the piece, the NSA says, "transitioning to a [zero trust] system requires careful planning to avoid weakening the security posture along the way." So what is the NSA talk…

I Think Possibly Maybe We've Solved Diversity in Cybersecurity

16 maart 2021 · 32 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/i-think-possibly-maybe-weve-solved-diversity-in-cybersecurity/

We're tired of hearing "we're trying" when it comes to the subject of how companies are trying to inject diversity into their organizations. It's a lopsided game and diverse candidates have to make ten times the number of attempts as their non-diverse counterparts.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and guest co-host Jimmy Sanders (@jfireluv), cybersecurity, Netflix DVD. Our guest this week is Jerich Beason (@blanketSec), svp, CISO, Epiq.

Thanks to our podcast sponsor, Living Security

Traditional approaches to security communication are limited to one-off training sessions that fail to take customers, regulators, and other external stakeholders into account and rarely affect long-term behavioral change. This report lays out a four-step plan that CISOs should follow to manage the human risk. It provides design principles for creating transformational security awareness initiatives which will win the hearts and minds of senior executives, employees, the technology organization, and customers.

On this week's episode

How have you actually pulled this off?

As discussed before on this show, being the next CISO at a company that was recently breached can be very lucrative. We've had guests that have very successfully negotiated huge salaries as the post-breach CISO. Are CISOs setting themselves up for far too much responsibility to be seen as a the company's digital savior? What are the responsibilities of a post breach CISO?

Got a better answer than "we're trying?"

Over the years we have interviewed dozens of business owners, security professionals, and hiring managers about diversity. Almost all their answers fall into the following buckets:

We're trying but there's no pipeline.

We're working with XXX group to improve.

Diversity is needed because diversity of thought…

Unnecessary Research Reveals CISOs Hate Cold Calls

9 maart 2021 · 35 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/unnecessary-research-reveals-cisos-hate-cold-calls/

In a study we never actually conducted, our fellow security leaders said unequivocally that there never has been a time they welcome a phone call from someone they don't know trying to book a demo to see a product they have no interest in.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and guest co-host Andy Steingruebl (@asteingruebl), CISO, Pinterest. Our guest this week is Andy Purdy (@andy_purdy), CSO, Huawei

Thanks to our podcast sponsor, Living Security

Traditional approaches to security communication are limited to one-off training sessions that fail to take customers, regulators, and other external stakeholders into account and rarely affect long-term behavioral change.
This report lays out a four-step plan that CISOs should follow to manage the human risk. It provides design principles for creating transformational security awareness initiatives which will win the hearts and minds of senior executives, employees, the technology organization, and customers.

On this week's episode

Here's some surprising research

As compared to small and medium companies, big enterprises don't appear to trust the big telcos to execute their 5G strategy. This according to new research from Omdia as reported by Iain Morris of Light Reading. When asked, "do you trust a communications service provider, AKA big telco, to execute your security strategy," SMEs overwhelmingly supported the telcos over all other options, and big enterprises didn't. They trusted their own expertise or wanted to lean on a cloud service provider like Amazon or Google. Let's investigate this discrepancy.

If you're not paranoid yet here's your chance

As if you didn't know it already, get ready for some sobering news about third-party risk: According to a survey by BlueVoyant, as reported by SC Magazine, 80 percent of those surve…

One Day You'll Grow Up to Know Less Than You Do Now

2 maart 2021 · 35 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/one-day-youll-grow-up-to-know-less-than-you-do-now

We know so little when we're born. We're just absorbing information. But then we get older, and get the responsibility to secure the computing environment of a large company, we actually see that knowledge we absorbed start slipping away. What we thought we knew of what's in our network is so far afield from reality.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Tomás Maldonado (@tomas_mald), CISO, NFL.

Thanks to our podcast sponsor, Nucleus Security

Nucleus unifies your existing security stack, integrating with over 70 scanners and external tools, creating a centralized hub to control the chaos of vulnerability analysis, triage, and remediation. Ready to make the tedious VM process simple through smart automation and workflow optimization? See for yourself at https://nucleussec.com/demo

It's time to measure the risk

Outside of security basics and popular controls like SSO, MFA, and password management, what are the most effective means (or security control) to reduce risk? People have been offering some great suggestions on LinkedIn such as reducing attack surface, knowing what you're protecting, education, more conversations about risk, and actually having someone in charge of security and risk. All reduce risk, but what truly gives the biggest bang for the buck in terms of risk reduction?

Are we making this situation better or worse?

When things break, what's the best tactic to remediation? A bigger/better version of the last thing, or critical thinking? Both actually have serious costs associated to them. The first being equipment and maintenance, and the second having the talent that's able to think of unique and innovative soluitons. In a post on LinkedIn, Greg van der Gaast of cmcg argues that bigger walls just result in continued security p…

Would You Look at that Unrealistic Licensing Deal?

23 februari 2021 · 38 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/would-you-look-at-that-unrealistic-licensing-deal/

CISOs know that salespeople want to make the best licensing deal they can possibly get. But unpredictability in the world of cybersecurity makes one-year licensing deals tough, and three-year licensing deals impossible.

This episode is hosted by David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Mark Eggleston, (@meggleston) CISO, Health Partners Plans.

This recording was recorded live in front of a virtual audience at the "SecTalks - Leading with grit in security" virtual conference brought to you by our sponsor, Cobalt.

Thanks to our podcast sponsor, Cobalt

Cobalt offers a faster more effective pentesting solution through its Pentest as a Service (PtaaS) platform. With it, you can schedule a pentest in as little as 24 hours for all kinds of assets. The platform also connects you with a global pool of pentesters called the Cobalt Core, whose skills can match what you need. And instead of sending you a huge PDF that raises more questions you can't answer, they engage with your team throughout the pentest. Findings can land straight into Jira and GitHub, helping you fix vulnerabilities as soon as they're discovered. Cobalt makes pentesting easy, quick to deploy, scalable, and simple to remediate.

On this week's episode

Why is everybody talking about this now?

A redditor is struggling and overwhelmed! The person is in school studying, working, and loving cybersecurity, but has completely and utterly failed the foundations course and is on academic probation. The person told their story to the cybersecurity subreddit community, and the support came out in droves. We've seen this before. People hit a major wall professionally and they just reach out to the anonymous masses for support. The story hits a nerve and the community is eager to show encouragement. In fact, just this past week,…

This Is the Year I'm Going to Lose Weight and Care About Security

16 februari 2021 · 33 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/this-is-the-year-im-going-to-lose-weight-and-care-about-security/

Every year I say I'm going to do it. I'm going to get healthy and be much better about securing my digital identity and my data. But then after about two weeks I give up, use the same password across multiple accounts, and eat a pint of Häagen-Dazs.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and guest co-host Dan Walsh, CISO, VillageMD. Our sponsored guest this week is Drew Rose, (@livsecaware)CSO, Living Security

Thanks to our podcast sponsor, Living Security

Traditional approaches to security communication are limited to one-off training sessions that fail to take customers, regulators, and other external stakeholders into account and rarely affect long-term behavioral change.

This report lays out a four-step plan that CISOs should follow to manage the human risk. It provides design principles for creating transformational security awareness initiatives which will win the hearts and minds of senior executives, employees, the technology organization, and customers.

On this week's episode

What would you advise?

Over on the AskNetSec subreddit, a pentester wants out. The redditor is looking for exit opportunities into another job in cybersecurity. Other redditors suggested IT audit, SOC operations, incident response, forensics. What would be an ideal next step for a pentester?

We don't have much time. What's your decision?

What happens when a previous employer of yours gets hacked and your information is potentially stolen. This happened to a redditor who asked this question on the cybersecurity subreddit. If nothing has actually happened, what can they do and what can potentially happen? Is a warning of "I may be compromised" to anyone going to do anything?

"What's Worse?!"

Jason Dance of Greenwich Associates delivers a really annoying "What's Worse?!" scenario.

Ple…

Please Accept This Not-a-Bribe Gift as an Act of Desperation

9 februari 2021 · 36 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/please-accept-this-not-a-bribe-gift-as-an-act-of-desperation/

Offering me a gift for a meeting was definitely not Plan A. Or was this a situation that you ran out of creative ideas and it's actually more cost efficient to buy your way into meeting with me?

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is
John Overbaugh, (@johnoverbaugh) vp, security, CareCentrix.

Thanks to our podcast sponsor, Nucleus Security

Nucleus unifies your existing security stack, integrating with over 70 scanners and external tools, creating a centralized hub to control the chaos of vulnerability analysis, triage, and remediation. Ready to make the tedious VM process simple through smart automation and workflow optimization? See for yourself at https://nucleussec.com/demo.

On this week's episode

OK, what's the risk?

People hear all too often that risk security isn't compliant security and vice versa, but isn't compliance just another form of risk? Shouldn't it be given quantitative and qualitative ratings like any other risk, prioritized, and remediated especially in highly regulated environments?

Why is everyone talking about this now?

On LinkedIn, LinkedIn CISO, Geoff Belknap asked, "Tech Vendors: Please, stop offering cash or gift cards for meetings. It throws into question the entire basis for a relationship and It's not ethical."

Vendors take CISOs out for lunch all the time. That is a form of a gift. One vendor said because they can't take a CISO out they send a Starbucks card in lieu of the coffee they were going to purchase. Then there are the gifts that arrive for attending an event.

Edward Kiledjian at OpenText, said, "I recently had a vendor get upset with me that I wasn't willing to accept his gifts. He said others in my position accept it and he couldn't understand why I was being so 'stubborn.'"

How should t…

Foul! That Interview Question Is Unfair

2 februari 2021 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

https://cisoseries.com/foul-that-interview-question-is-unfair/

Pick a side. You either want your employees to have a work/life balance, or you want them to be obsessed with security 24/7. You can't have both.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Arpita Biswas, (@0sn1s) senior incident response engineer, Databricks

Thanks to our podcast sponsor, StackRox

StackRox is the industry's first Kubernetes-native security platform that enables organizations to securely build, deploy, and run cloud-native applications anywhere. The StackRox Kubernetes Security Platform delivers lower operational cost, reduced operational risk, and greater developer productivity through a Kubernetes-native approach that supports built-in security across the entire software development lifecycle.

What would you advise?

People speak a lot about the importance of integrating security and DevOps. Now it's time to learn some specifics, like how to energize developers to be more security minded in their development. What works? What hasn't worked?

"What's Worse?!"

You just learned something was breached. Uggh. (Thanks to Mike Toole, Censys)

What's the best way to handle this ?

What questions should be asked to see if a security team is cloud incident ready? A good article over on F5 by Sara Boddy, Raymond Pompon, and Sander Vinberg, provides some suggestions such as "Can you describe our attack surface and how have you reduced it to the bare minimum?" and "How are we managing access control?" and "What do we do when systems or security controls fail?" Which of the questions is the most revealing to cloud security readiness and why?

Should you ignore this security advice?

On the AskNetSec subreddit someone inquired about a good hiring question. One redditor suggested asking "What do you do on your own home network with respect to security?" to…

Why Do We Fire the CISO? Tradition!

26 januari 2021 · 35 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

(https://cisoseries.com/why-do-we-fire-the-ciso-tradition/)

Yes, firing the CISO probably won't solve our security issues. But our community has a multi-generational heritage of relying on scapegoats to make them feel good about their decisions.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Kirsten Davies (@kirstendiva), CISO, Estee Lauder Companies.

Thanks to our podcast sponsor, Kenna Security

With Kenna Security, companies efficiently manage the right level of risk for their business. Our Modern Vulnerability Management model eliminates the friction between Security and IT teams about what to patch, providing clear prioritization based on real-time threat intelligence and guidance applied to each customer's unique environment across infrastructure, applications and IoT.

Why is everybody talking about this now?

On the AskNetSec subreddit one redditor asked, "Why do people always get fired over a breach?" to which one responded, like many others, "it's just tradition. Military, government, corporations. It's an old-fashioned thing really, but a lot of people still believe a 'blood sacrifice' is required to restore faith from the public or the shareholders." How tenable is it to keep doing this with so many breaches? After a breach what are the different actions needed to appease shareholders, executives, employees, and customers? And when is blood letting warranted?

How to become a CISO

Over on the CISOseries subreddit, a hopefully soon-to-be-CISO asked, "What should I ask before being a CISO at a startup?" This startup is pre-IPO. 2000 employees. About $1B in valuation. The redditor is looking for advice beyond asking what's the current security strategy and what the reporting structure would look like. What would you want to ask in such a situation?

"What's Worse?!"

Probably the ultimate "What's Worse?!" scenario.

…

Click This Link to Fail a Phishing Test

19 januari 2021 · 33 min

Afspelen

All links and images for this episode can be found on CISO Series Lees meer

(https://cisoseries.com/click-this-link-to-fail-a-phishing-test/)

Our phishing tests are designed to make you feel bad about yourself for clicking a link. We're starting to realize these tests are revealing how insensitive we are towards our employees.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Yaron Levi, (@0xL3v1) former CISO, Blue Cross Blue Shield of Kansas City.

Thanks to this week's podcast sponsor, Stackrox

StackRox is the industry's first Kubernetes-native security platform that enables organizations to securely build, deploy, and run cloud-native applications anywhere. The StackRox Kubernetes Security Platform delivers lower operational cost, reduced operational risk, and greater developer productivity through a Kubernetes-native approach that supports built-in security across the entire software development lifecycle.

Is this a cybersecurity disinformation campaign?

On reddit, an explosive discussion formed around a ComputerWeekly.com article by Saj Huq of Plexal about the importance of making disinformation a security issue. The problem though has primarily fallen into the hands of social media companies mostly because that's where disinformation spreads. While we've seen disinformation being used as a political tool, for businesses, it can tarnish your corporate brand, consumer trust, and ultimately the value of your product. It's also used in phishing campaigns. Breaches are compromising your data. Disinformation is questioning the validity and value of data without even stealing it. How do you combat that?

Are we having communication issues?

We're recording this episode shortly after GoDaddy sent its infamous phishing test email that promised employees a $650 bonus check. Those who clicked on the email were rewarded with additional security training. It took the entire Internet to point out how insensiti…

Our "Hope It Doesn't Happen to Me" Security Strategy

12 januari 2021 · 30 min

Afspelen

All links and images for this episode can be found on CISO Series https://cisoseries.com/our-hope-it-doesnt-happen-to-me-security-strategy/ Lees meer

We're thinking it just might be possible to wish our security problems away.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest this week is Steve Giguere, (@_SteveGiguere_) director of solution architecture and community, StackRox.

Thanks to this week's podcast sponsor, Stackrox

StackRox is the industry's first Kubernetes-native security platform that enables organizations to securely build, deploy, and run cloud-native applications anywhere. The StackRox Kubernetes Security Platform delivers lower operational cost, reduced operational risk, and greater developer productivity through a Kubernetes-native approach that supports built-in security across the entire software development lifecycle.

On this week's episode

That's something I would like to avoid

Security theater is a security placebo. We're being told that it's effective, and we may fool ourselves into believing it is, but the reality is there's no real security medicine there. Over on Infosecurity Magazine, Danny Bradbury has identified a few key ones I want to call out. In particular, technology buzzwords - like getting a solution with AI, data collection - more data, more insights, right?, and endless security alerts - for practitioners and end users. All of these seem to be in regular practice today. Does calling out security theater result in pushback? And if so, how do you handle calling it out and how would you shift each of these security placebos into a more medicated version?

There's got to be a better way to handle this

On reddit, kautica0 asks, "If a company becomes aware of a 0-day vulnerability and it impacts their production web application serving customers, what actions should be taken? Should it even be considered an incident?"

Just because it's a 0-day vulnerability does that m…

Hey Reseller, What's the "Value" You're Adding?

5 januari 2021 · 37 min

Afspelen

All links and images for this episode can be found on CISO Series (https://cisoseries.com/hey-reseller-whats-the-value-youre-adding/) Lees meer

It seems that you're offering so much more when you add the VA ("value added") in front of your title. What is that? Why am I working with you rather than buying directly from the vendor?

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Doug Cahill (@dougcahill), vp, and group director, cybersecurity, Enterprise Strategy Group.

Thanks to this week's podcast sponsor, Dtex

Traditional Employee Monitoring solutions are creepy. Capturing screenshots, recording keystrokes, monitoring web browsing and following social media activities is unnecessary and damages culture. DTEX InTERCEPT is the first and only solution that delivers the real-time workforce monitoring capabilities today's organizations need and employees will embrace. Learn more at dtexsystems.com.

On this week's episode

How a security vendor helped me this week

From Trevor Marcatte, The SCE Group, asks a question about the "value added reseller" or VAR vs. the "large account reseller" or LAR.

I'm paraphrasing, but Trevor wants to know what we're seeing as the value of this middleman. Trevor said, "Being the middle man is tough and battling the big guys is tough. CDW's, SHI's of the world. The smaller guys have so much more to offer than a price. Price is dictated by the vendor anyways."

What do the smaller VARs have to offer that the larger LARs can't offer?

How do you go about discovering new security solutions

How do we evaluate DevSecOps solutions? Mike hates the term, so I'll say how do we evaluate solutions that will improve the security of the DevOps pipeline? GigaOM Research has a report where they evaluate these solutions, but they also have another report that goes into detail on evaluation criteria. There is a lot of criteria such as seamless integration into tools, process, and dashboard…

The People Closest to You Will Hurt You

15 december 2020 · 36 min

Afspelen

All links and images for this episode can be found on CISO Series (https://cisoseries.com/the-people-closest-to-you-will-hurt-you/) Lees meer

Insider threats. We know some are malicious, and sometimes it's the unwitting result of someone trying to do their job. Aren't you supposed to trust the people you hire?

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest this week is Dr. Deanna Caputo, chief scientist for behavioral sciences and cyber security capabilities, senior principal behavioral psychologist for MITRE.

Thanks to our sponsor, Dtex.

Traditional Employee Monitoring solutions are creepy. Capturing screenshots, recording keystrokes, monitoring web browsing and following social media activities is unnecessary and damages culture. DTEX InTERCEPT is the first and only solution that delivers the real-time workforce monitoring capabilities today's organizations need and employees will embrace. Learn more at dtexsystems.com.

On this week's episode

What we've got here is failure to communicate

Breaking News! The cybersecurity skills shortage is growing. The ISSA and Enterprise Strategy Group released a report claiming the reason that 70 percent of companies feel that they're at risk is because of the increased workload for cyber professionals, unfilled open job requisitions, and poor education on the relevant technologies. This discussion appeared on the cybersecurity subreddit and complaints ranged from entry level jobs asking for 3+ years experience (something we've discussed many times before), and people with many more years of experience struggling to find a job. Others who were contemplating entering cybersecurity said the discussion was turning them off from entering the field.

There's supply and demand, yet there's frustration on both ends. Why aren't they connecting? What's going on?"

Are we making this situation better or worse?

What defines "usable security". We've discussed obvious things l…

When Should You Stop Trusting Your CISO?

8 december 2020 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series (https://cisoseries.com/when-should-you-stop-trusting-your-ciso/) Lees meer

How technically capable does my CISO need to be? If they lose their technical chops, should we stop trusting them? Should they even be a CISO if they had no technical chops to begin with?

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is James Dolph, CISO for Guidewire Software.

Thanks to our sponsor, Dtex.

Traditional Employee Monitoring solutions are creepy. Capturing screenshots, recording keystrokes, monitoring web browsing and following social media activities is unnecessary and damages culture. DTEX InTERCEPT is the first and only solution that delivers the real-time workforce monitoring capabilities today's organizations need and employees will embrace. Learn more at dtexsystems.com.

On this week's episode

We mentioned past guest, Kelly Shortridge's new book with Aaron Rinehart, "Security Chaos Engineering".

First 90 days of a CISO

It's time for a CISO do-over. One of the great things about being a CISO is you get a chance to actually apply everything you learned from past jobs. Our guest, James, worked in product security with Salesforce before becoming a CISO. When we recorded the episode, James wasn't yet a full 90 days into his job. And Mike also came from Salesforce as well (they worked together) and working at Lyft was his first CISO job directly from Salesforce as well. Did they both have the same viewpoints of applying product security principles to the CISO role?

How do you go about discovering new security solutions

What criteria do you use to evaluate phishing solutions? GigaOM Research released a report earlier this year of the key criteria for evaluating phishing platforms. Some of the criteria they mentioned were phishing solutions that do and do not impede workflows, a security edge solution that's in-band vs. out-of-band, and do you nee…

Why Is 'Pay the Ransom' In Next Year's Budget?

1 december 2020 · 34 min

Afspelen

All links and images for this episode can be found on CISO Series (https://cisoseries.com/why-is-pay-the-ransom-in-next-years-budget/) Lees meer

With 25 percent of ransomware victims paying the ransomware, have we waved the white flag to the attackers? Should we just budget for it?

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest is Les McCollum (@doinmorewithles), managing vp, CISO, ICMA-RC.

Thanks to our sponsor, BitSight.

BitSight is the most widely used Security Ratings service with a mission to change the way the world addresses cyber risk. Learn how BitSight for Third-Party Risk Management helps you efficiently mitigate the growing risk across your vendor ecosystem by taking an automated, data-driven approach.

On this week's episode

Why is everybody talking about this now

Are culture fit and diversity mutually exclusive? Allan Alford, co-host of Defense in Depth podcast, brought up the conversation of needing diversity in all areas: age, gender, ethnicity, city vs. country, country of origin, military vs. civilian, college educated vs. self-taught, socioeconomic status, and disabilities. But at the same time, I'm thinking we NEVER see those types of groups hanging out together or getting along. So how do you create a culturally sane group among such a diverse group? People are tribal by nature and even if you're successful creating diversity on your team they're going to bond with people of similar types. Won't this introduce new problems?

If you haven't made this mistake you're not in security

At the end of the year when you look at your security budget, what are the costs you didn't expect or budget appropriately at the beginning of the year? On CSO Online, John Edwards has an article about seven overlooked cybersecurity costs that may bust your budget. He mentioned items such as staff acquisition and retention, incident response, third-party analysis, and rep…