CISO Series Podcast

All links and images for this episode can be found on CISO Series (https://cisoseries.com/i-want-to-but-i-just-cant-trust-your-single-pane-of-glass/) I've already got a view into my company's security. It's going to take a lot to get me to to dump it for your solution. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Joshua Scott (@joshuascott94), former CISO, Realtor.com. HUGE thanks to our sponsor, Kenna Security. With Kenna Security, companies efficiently manage the right level of risk for their business. Our Modern Vulnerability Management model eliminates the friction between Security and IT teams about what to patch, providing clear prioritization based on real-time threat intelligence and guidance applied to each customer’s unique environment across infrastructure, applications and IoT. On this week's episode First 90 days of a CISO How do you define the likelihood of impact? Yaron Levi, CISO, Blue Cross Blue Shield of Kansas City, shared an article by Brian Spanswick of Splunk who discussed this process of building out a company's security program, and that mission should be "mitigate the likelihood and potential business impact of a breach while supporting an organization's strategic goals and business objectives." Our guest was Realtor.com's first CISO. He built their cybersecurity program from scratch. We talked about how he reduced impact while staying keen to the organization's objectives. How do you go about discovering new security solutions In the last three years, where have our guests successfully innovated in cybersecurity? Why did they do it? And where do they think they need the next innovation? What's Worse?! How much battle damage do you want your CISO to have? Can you change Mike's mind Mike inspired me to ask this question on Twitter, "What would a single pane of glass need to have for you to dump your current pane of glass?" This was has major argument that each single pane of glass requires him to dump his current one. The question is what type of mountain does a security vendor need to climb for him to unload his current view of his security program. What Is It and Why Do I Care? Today's topic is threat detection and I'm a little loose on this as I got slight variations on threat detection from insider threats, to SIEM, to just threat detection. I'm lumping them all into the umbrella of threat detection, but it'll be obvious which is which. Vendors send various pitches explaining their category and also explaining what differentiates them. Mike and our guest will determine which is the best and from that and I will announce the winners, but only the winners.

All links and images for this episode can be found on CISO Series (https://cisoseries.com/security-is-suffering-from-devops-fomo/) Darn it. DevOps is having this awesome successful party and we want in! We've tried inserting ourselves in the middle (DevSecOps) and we launched a pre-party (shift left), but they still don't like us. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our sponsored guest this week is Dayo Adetoye (@dayoadetoye), senior manager - security architecture and engineering, Mimecast. Thanks to our sponsor, Capsule8. Capsule8 is defining modern enterprise protection by providing detection and response for Linux infrastructure in any environment. Capsule8 provides host-based detection and investigatory data for incident response with on-going support. Unlike anyone else, Capsule8 mitigates the financial, scalability and reliability limitations of protecting your Linux infrastructure. On this week’s episode Are we making the situation better or worse? What makes a successful phish? On Sophos' blog Paul Ducklin writes about their most successful phishing emails. Ducklin noted that most of the successful phishes dealt with mundane and undramatic issues that still had a sense of importance. Looking at these examples they do seem to follow a similar pattern of something looking official that is being requested from the company and could you click here to check it out. Is that the majority of what you're testing? If so, what exactly is the value in conducting phishing tests on employees? Can the testing have a negative effect in security or even morale? There’s got to be a better way to handle this What is the right approach to threat modeling? In a blog post, Chris Romeo of Security Journey opines that formal training or tools won't work. Security needs to ask questions of developers about features and then show them how a threat evolves, thus allowing them to ultimately do it themselves. Adam Shostack of Shostack and Associates advocates for formal training. He says Romeo's informal approach to threat modeling sounds attractive, but doesn't work because you're trying to scale threat modeling across developers and if you tell one developer the information it's going to be passed down like a game of telephone where each successive person tells a distorted version of what the last person said. So what's the right approach to building threat models across a DevOps environment? What's Worse?! What's the worst place to find your company assets? Close your eyes and visualize the perfect engagement Shifting Left. DevSecOps, These are the mechanisms that have been used to infuse security into the DevOps supply chain. While noble, both concepts break the philosophy and structure of DevOps which is based on automation, speed, and delivery. But, DevOps is also about delivering quality. So rather than inserting themselves, how does security participate in a way that DevOps already loves? If you haven’t made this mistake, you’re not in security On AskNetSec on reddit, Triffid-oil asked, "What was something that you spent effort learning and later realized that it was never going to be useful?" And let me add to that, it's something either someone told you or you believed for some reason it was critical for your cybersecurity education and you later realized it wasn't valuable at all.

All links and images for this episode can be found on CISO Series (https://cisoseries.com/enjoying-my-blissful-ignorance-of-cyber-vulnerabilities/) What keeps me up at night? Nothing! That's because I hold onto cybersecurity myths because it makes me believe I don't have a security problem. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Dustin Wilcox, CISO, Anthem. Thanks to our sponsor, Capsule8 Capsule8 is defining modern enterprise protection by providing detection and response for Linux infrastructure in any environment. Capsule8 provides host-based detection and investigatory data for incident response with on-going support. Unlike anyone else, Capsule8 mitigates the financial, scalability and reliability limitations of protecting your Linux infrastructure. On this week’s episode Why is everybody talking about this now Kris Rides of Tiro Security asks, "When writing a job description in cybersecurity, what's your process?" What in the job description is most important that you want potential candidates to know? And do you have any universal requirements of all candidates? Is this a cyber security disinformation campaign? Stuart Mitchell of Stott and May posted an article from FoxNews on cybersecurity myths, such as I don't have anything worth protecting, I will know when something bad happens. From this list, or possibly another myth, which one do you think is the most damaging? What's Worse?! Public or government interference? There’s got to be a better way to handle this Why are InfoSec professionals still struggling to secure their cloud environments? According to a study by Dimension Research, sponsored by Tripwire, 76 percent admit to having trouble. And only 21 percent they're assessing their overall cloud security posture in real time or near real time. What are the quarter of security professionals doing who are not struggling with securing the cloud? Close your eyes and visualize the perfect engagement Do we need more cybersecurity professionals, or do we just need our general workforce to be more cybersecurity minded? Phil Venables, Board Director - Goldman Sachs Bank, makes a good argument for the latter. Mike has mentioned that when he can make cybersecurity personal, like offering employees a password manager, they start to see the value. Assuming making security personal is the best tactic, what is the ripple effect of that? How do they approach security at your business and how do the efforts of the security team change?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/tell-me-were-secure-so-i-can-go-back-to-ignoring-security/) I don't know anything about our state of security. I don't want to know either. But I do want to know you know about security and there's nothing I have to worry about. You can do that, right? This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Dan Walsh, CISO, Rally Health. Thanks to our sponsor, Capsule8. Capsule8 is defining modern enterprise protection by providing detection and response for Linux infrastructure in any environment. Capsule8 provides host-based detection and investigatory data for incident response with on-going support. Unlike anyone else, Capsule8 mitigates the financial, scalability and reliability limitations of protecting your Linux infrastructure. On this week's episode Why is everybody talking about this now How do you respond to "Are we secure?" It's a loaded question that we've addressed previously. Daniel Hooper, CISO, Varo Money brought up this topic again that caused a flurry of discussion on LinkedIn. In the past Mike has mentioned that he talks about the state of his security program and where it's heading. The core of this question is anxiety about something a non-security person doesn't understand. How does a security leader break down this question into small parts, and what question should a CEO be asking if not "Are we secure?" There’s got to be a better way to handle this The engineering team at Rally Health is around 800 and our guest Dan has a security team of 30+ of which only 5 of them are application security people. Those five are definitely going to need some help if they're going to have an impact on how secure the applications are. I ask Dan Walsh what he's doing with the engineers that's turning them into application security force multipliers. What's Worse?! How damaging is a bad reputation? What do you think of this vendor marketing tactic? CISOs have ways to retalilate against aggressive sales tactics. George Finney, CISO at Southern Methodist University told a story on LinkedIn about an unsolicited sales invite that was sent to 65 people at his school. He blocked the email. He asked the community if that was too harsh. Similarly Steve Zalewski, deputy CISO of Levi's said if he sees aggressive tactics by a company, the security team has the ability to block the whole domain from their servers. Are these tactics too harsh? Have Mike and our guest taken similar tactics, and/or is there something else they do in response to extremely aggressive sales tactics? If you haven’t made this mistake, you’re not in security How prepared do you need to handle your next cyber job? A question was asked on reddit from someone who wasn't sure they should take a job because they didn't have all the skills to do the job. Most people just said, "Do it." How would Mike and our guest answer this question as an employee and a manager. What level of unpreparedness for a job is acceptable and possibly even exciting? Could too much result in imposter syndrome?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/request-a-demo-of-our-inability-to-post-a-demo/) It's really easy to include "Request a Demo" button on our site. But potential buyers would actually like to just watch a demo on our site. Should we actually expend just a little more effort to record a demo and upload it to our site? This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Ross Young, CISO, Caterpillar Financial Services Corporation. Thanks to our sponsor, Kenna Security. With Kenna Security, companies efficiently manage the right level of risk for their business. Our Modern Vulnerability Management model eliminates the friction between Security and IT teams about what to patch, providing clear prioritization based on real-time threat intelligence and guidance applied to each customer’s unique environment across infrastructure, applications and IoT. On this week's episode Why is everybody talking about this now? Our guest posted about the 10+ daily product pitches he receives and he suggested that vendors place a product demo on their site. It just so happens, I also posted about this on LinkedIn. I am astonished that not every vendor spends their first marketing dollars on creating a product demo and posting that video. If a security practitioner is interested in a company, how do they begin their research? What do they look for? Do they watch product demo videos? Do they click the "request a demo" button? First 90 Days of a CISO Our guest shared a study from PWC that points out what management thinks are the most important roles for a CISO. Eighty four percent considered the ability to educate and collaborate across the business was critical making it the top most skill they look for in a CISO. At the same time, it appears investing in a talent management program for leadership was the least important with only 22 percent responding. What I read from this is management wants you to lead, and get the whole company on board, but do it alone. Plus, they expect you to be a perfect cybersecurity leader out of the box. Is that feasible? Is this why we're having so much burnout of CISOs? It's not just the pressure of protecting, but taking on all leadership responsibilities with no ongoing support? What's Worse?! How are you advertising for new hires? There’s got to be a better way to handle this Turns out half of employees are cutting corners on security when working from home. This includes using home computers for corporate work, emailing sensitive documents from personal accounts. It's not malicious, but the distractions of work from home life and demands to deliver quickly are forcing employees to take the less secure route. Also, being away from the watchful IT and security gives them the breathing room to be less careful. Tip of the hat to Gina Yacone of Agio for posting this article from ZDnet about Tessian's work from home study. How can security leaders stay in contact with employees so they don't stray? How CISOs are digesting the latest security news What makes a security podcast valuable? What elements does a cybersecurity podcast need to have for you to say to yourself, "I'm glad I spent the time listening to that"?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/the-do-what-we-tell-you-technique-isnt-working/) We've yelled, we've screamed, we've complained, and we've whined. Those darn users simply don't do what they tell them to do. I guess we're going to have to give empathy a try. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Michelle Valdez (@scauzim), CISO, OneMain Financial. Thanks to this week’s podcast sponsor, PlexTrac. PlexTrac is a revolutionary, yet simple, cybersecurity platform that centralizes all security assessments, penetration test reports, audit findings, and vulnerabilities into a single location. PlexTrac vastly improves the risk management lifecycle, allowing security professionals to generate better reports faster, aggregate and visualize important analytics, and collaborate on remediation in real-time. On this week's episode Why is everybody talking about this now Why hasn't COVID spurned more disaster recovery and business continuity planning roles? This is what Stuart Mitchell, a recruiter at Stott and May, noticed. Obviously, he's not getting that much demand. The community says it's assumed already into many roles. I have to think BCP and DR are everyone's responsibility. If that's the case, has BCP and DR planning increased during this time? Why or why not? How to become CISO Are two CISOs better than one? Our guest mentioned that her company has split the CISO role. One, the head of tech, reports to the CTO and the other, our guest's role, CISO and head of cyber risk reports to the chief risk officer. How exactly does this work? And what does our guest believe are the pros and cons of splitting the CISO role this way? What's Worse?! This time, no matter what the answer, everyone's going to get in trouble. And now for a little security philosophy Chad Loder, Habitu8, said, "Us InfoSec experts spend too much time asking 'How do we get users to care more about security?' and not enough time asking 'How do we get security to care more about users?'" So I asked my host and guest that question, and more importantly, how has that learning about users improved their security team and overall security? First 90 days of a CISO William Birchett, CIO of Required Team Gear, asked, "When you start, how much do you know of what security posture you've inherited?" We've talked about this before, but I want you to answer in reflection. What were the biggest surprises (positive or negative) between what you knew starting out and what you discovered after 90 days on the job?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/set-it-forget-it-reset-it-repeat/) As long as you reset it and repeat, everything in cybersecurity is "set it and forget it". This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Brett Conlon (@DecideSecurity), CISO, Edelman Financial Engines. Check out Tricia Howard's dramatic readings of cold emails. Our Keyavi breaks new ground by making data itself intelligent and self-aware, so that it stays under its owner’s control and protects itself immediately, no matter where it is or who is attempting access. Keyavi is led by a team of renowned data security, encryption, and cyber forensics experts. See for yourself at keyavidata.com. On this week's episode Why is everybody talking about this now On LinkedIn and on Twitter, I asked "Is there anything in cybersecurity that's 'set it and forget it'?" There were plenty of funny answers like "Passwords" and the "Off" switch. But there were some interesting answers like whitelists from Brian Haugli of Sidechannel security and ethics from Stephen Gill of Russel Holdings. So many treat security as "set it and forget it" but we know that's a path to insecurity. Regardless, is there ANYTHING in security we can set and forget? Question for the board Our guest claims he's got an awesome board. I don't think we've ever heard that on our show. In most cases there's either fear of the board or the CISO doesn't even get direct conversation with the board. I asked our guest what is it about his board that's so awesome and what tips could he give to CISOs to move their board into that territory? What's Worse?! Who is going to handle physical assets the worst? If you haven’t made this mistake, you’re not in security Alexander Rabke, Splunk, asked, "How should sales people handle situations when, in fact, you are a security company with a security vulnerability (he also talked about a product not working) - what do you tell customers. How do you like to see this handled by the vendor?" I know a first response is to be honest, but they want to hold onto your business. What's a way salespeople could go about doing that? What do you think of this pitch? We're not talking vendor pitches in this segment. We're talking candidate pitches. Gary Hayslip, CISO, Softbank Investment Advisers and former guest on this show has an article on Peerlyst, a platform which is unfortunately going away, about finding your first job in security. Hayslip's first tip asks, "What information do you have?" Researching yourself is good advice, but I want to extend that to a question that I think puts you ahead of the pack and ask, "What's your unfair advantage?" It's a question that I heard investor Chris Sacca ask startups and I think it can also apply to individuals applying for jobs. Agree? If so, what are some good unfair advantages from candidates that have put them over the top?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/i-need-resources-to-free-up-my-resources) Automation sounds wonderful and I'd love to have some free time, but geez, who do I need to hire to make that happen? This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our sponsored guest this week is Aaron Ansari (@theanswar), VP, Cloud One, Trend Micro. Thanks to this week's podcast sponsor Trend Micro. Trend Micro Incorporated, a global leader in cybersecurity solutions, helps to make the world safe for exchanging digital information. Our innovative solutions for consumers, businesses, and governments provide layered security for data centers, cloud environments, networks, and endpoints. For more information, visit www.trendmicro.com. On this week's episode There’s got to be a better way to handle this How well has the cybersecurity automation gambit played itself out? Last year, Ericka Chickowski wrote a piece on Dark Reading about the cybersecurity automation paradox. She said that "security teams find that a lack of automation expertise keeps them from getting the most out of cybersecurity automation." According to a Ponemon study, that accounts for 56% of organizations. That's the number one obstacle. It's more than legacy IT challenges, lack of budget, and interoperability issues. 40% of respondents say they'll need to hire more people to support security automation. Everyone speaks of wanting automation, but is it more of an aspiration and a marketing pitch? Has it specifically alleviated any pain over the past year. And if so, what? What annoys a CISO? For my co-host MIke Johnson, the annoyance is the "single panes of glass" that so many security vendors offer. Our guest, Aaron Ansari is ready to challenge Mike on his grand distaste for "the single pane of glass" as the window to your security status/infrastructure/whatever you like it to be. "What's Worse?!" What's worse, failure but honesty, or success and deception? Please, Enough. No, More. Topic is "cloud configuration." What have we heard enough about with cloud configuration, and what would we like to hear a lot more? Ummm. Maybe you shouldn’t have done that We're talking about vendor lock-in. It makes recurring sales for vendors super easy. But it makes exit strategies very difficult. On Quora, the question was asked, "How do huge companies like Netflix avoid vendor lock-in with a cloud computing provider?" So I ask the question to both of you, what safeguards can you setup to prevent vendor lock-in or at least make an exit from a cloud provider as painless as possible? Creative Commons photo attribution to Alden Jewell (CC BY 2.0)

All links and images for this episode can be found on CISO Series (https://cisoseries.com/were-not-fooled-by-your-diversity-theater/) We're casting for our diversity theater program on the latest episode of CISO/Security Vendor Relationship Podcast. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Matt Conner, CISO, National Geospatial Intelligence Agency. Thanks to this week's podcast sponsor, PlexTrac PlexTrac is a revolutionary, yet simple, cybersecurity platform that centralizes all security assessments, penetration test reports, audit findings, and vulnerabilities into a single location. PlexTrac vastly improves the risk management lifecycle, allowing security professionals to generate better reports faster, aggregate and visualize important analytics, and collaborate on remediation in real-time. How CISOs are digesting the latest security news If you thought tech firms were abysmal with diversity hiring, it appears venture capital firms are even worse. In a Washington Post article by Nitasha Tiku, just 1 percent of VC dollars went to black start-up founders in 2018, and that same year and percentage reflects the number of black decision-makers at VC firms as well. With the scrutiny turned up, small minority-focused funds have spurned, and there has been some cosmetic title inflation of minority employees at VC firms, but black tech entrepreneurs are brushing it off as diversity theater. What opportunities and money are VC firms leaving on the table by not taking diversity seriously? What should VC firms do to prove that their efforts are not diversity theater? We don’t have much time. What’s your decision? Interesting question on reddit by throwawaycostam who asks, "How do you create easy to memorize, yet relatively strong passwords?" A password manager is first and foremost recommended, but there are cases where you do have to remember a few passwords, like the one to get into your password manager and desktop screen lock. If you have to memorize five really good complex passwords, what technique do you recommend to create those passwords? What's Worse?! Is clueless better than not being engaged? It’s time for “Ask a CISO” On a previous episode, CISO, Dennis Leber, now with University of Tennessee Health Science Center, but previously with a state government agency said there's no perfect pitch a vendor could make to him that would facilitate a sale. Heck, he couldn't even write the perfect pitch to himself that would work. We know the government is a different beast when it comes to procurement. What are the stumbling blocks vendors need to concern themselves when pitching a government agency? We’ve got listeners and they’ve got questions Jesse Rosenbaum of Varonis brought a job posting to my attention that showed requests for extremely specific experiences with different applications. Jesse asks, does the listing the name of products or protocols you're using expose the company to additional security risks? Isn't this the reason so many customers of security vendors are not willing to give testimonials? But if they're putting these products and protocols in job descriptions, isn't this the same darn thing?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/how-to-tell-if-your-ciso-sucks-at-their-job/) If your CISO wants to be a 'visionary' but they can't seem to pull off basic security functions, they probably suck at their job. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Lee Parrish (@leeparrish), CISO, Hertz. Thanks to this week's podcast sponsor, Keyavi Data. Our Keyavi breaks new ground by making data itself intelligent and self-aware, so that it stays under its owner’s control and protects itself immediately, no matter where it is or who is attempting access. Keyavi is led by a team of renowned data security, encryption, and cyber forensics experts. See for yourself at keyavidata.com. On this week's episode Is this the best use of our Money On CSO Online, Terena Bell has a piece on how to cut your budget without hurting security. The suggestions are well known: Identify overlaps in technology, renogiate contracts, and use tech to lower the need for manhours. Her last tip was a warning about layoffs. Are you always looking to reduce costs or is it something you do when it's mandated? And how are you supported by the business if and when you proactively reduce costs? Or does that not ever happen because the demand is ever growing. Is this where I should put my marketing dollars? I'm not sure, but it's possible that our guest is our first CISO that has an MBA. In his role as CISO he's mentioned he uses common marketing techniques to advance your organization's cybersecurity program. He said, "Security is just an inside sales job and that marketing creates the demand that sales fulfills." Lee tells us about what he learned in his MBA training that was so critical for your growth as a CISO. What's Worse?! We have a split decision on third party risk management. How a security vendor helped me this week We haven't done this segment in a long time and we got a request from a listener to bring it back. So I ask Mike and our guest, recently, how has a security vendor helped you. And were any of those security vendors who helped not customers? We’ve got listeners and they’ve got questions A listener, who wishes to remain anonymous asks this question: "How do you convince a CISO to focus on the basics?" The listener goes on and says, "I'm not a CISO but have seen and talked to many that want to be seen as 'visionaries' so they focus on 'new hotness' things like 'zero trust' instead of the basics things that are missing like patching, asset management, etc." The listener understand this, and he's obviously talking about his own CISO, hence the anonymity, but how do you approach your CISO and get him or her to balance their own time with basics or as Yaron Levi, CISO of Blue Cross Blue Shield of Kansas City says, "fundamentals" while also having a forward looking vision of security?