Secure Talk Podcast

In this episode of Secure Talk, Justin welcomes Stephen Ferrell, a cybersecurity expert and Chief Strategy Officer of Strike Graph, to discuss the significant changes in the compliance landscape brought about by the Cybersecurity Maturity Model Certification (CMMC). They explore the recent finalization of the CMMC rule, its implications for the defense industrial base, and the phased compliance requirements for various certification levels. The conversation emphasizes the necessity of CMMC for federal contractors, including those in non-traditional sectors like medical equipment manufacturing, along with the associated costs and procedures. Stephen also shares insights from his experience conducting a self-assessment for CMMC compliance, offering practical advice for organizations aiming to achieve certification. This episode is essential for cybersecurity professionals who want to understand the latest federal compliance standards and prepare their organizations accordingly.

Privacy laws in our modern computing era have been around for well over twenty years. The conversation around appropriate privacy measures and effective governance of data has matured quite nicely since the early days of the Internet. While breaches do continue to happen, laws like GDPR, HIPAA and CCPA have helped set expectations for ethical and effective privacy practices.But we are in the midst of a massive proliferation of generative AI models. Since the technology is so nascent our expectations of privacy are being reshaped. An AI model is fundamentally a mathematical representation of a large data set. Its probabilistic function will create information depending on the prompts it can be given. Deep in the model the data used to ‘train’ it still leaves a fingerprint of the source information. What are the expectations for privacy, copyright and safety to those of us that have shared information on the internet?In this episode of Secure Talk, host Justin Beals engages in a comprehensive discussion with Dan Clarke,  about the significant impact of AI. The conversation begins with Dan’s early days in computing and follows his journey into developing AI governance. They explore the transformative effects of AI in comparison to historical technological innovations, as well as the risks and biases that are inherent in AI systems. Additionally, they discuss current and future legal compliance issues.Dan shares personal anecdotes related to privacy challenges and the applicability of AI, emphasizing the importance of transparency, thorough risk assessment, and bias testing in AI implementations. This episode provides valuable insights for anyone interested in the ethical and responsible use of AI technology in today's applications.00:00 Welcome to SecureTalk: Exploring Information Security00:32 The Evolving Landscape of Privacy and AI01:47 Introducing Dan Clark: AI Privacy Leader03:10 Dan Clark's Journey: From Intel to Privacy Advocacy04:14 The Impact of AI: Paradigm Shifts and Privacy Concerns06:08 Personal Data and Privacy: A Real-Life Story08:45 The Importance of Data Control and Fairness13:10 AI Governance and Legal Responsibilities21:02 Current Laws Impacting AI and Privacy26:47 Legal Basis for Data Usage27:01 Introduction to Truio and InnerEdge27:29 The Birth of Truio: Addressing GDPR28:39 AI Governance and Federal Privacy Law30:48 Transparent AI Practices31:58 Understanding AI Risks and Transparency36:52 AI Use Cases and Risk Assessment44:57 Bias Testing and AI Governance50:39 Concluding Thoughts on AI and GovernanceLink: https://get.truyo.com/ai-governance-training

In this episode of Secure Talk, host Justin Beals, CEO and founder of Strike Graph, discusses cybersecurity awareness training with Craig Taylor, CEO and co-founder of CyberHoot. They explore the evolution and significance of security training, particularly in light of the rising number of phishing attacks. Taylor shares insights from his extensive background, including being a senior risk analyst for Computer Sciences Corporation in the development of one of the first cloud hosting platforms. He also shares his experience as a virtual Chief Information Security Officer (vCISO) and the growth and success of CyberHoot. The conversation highlights CyberHoot's innovative use of positive reinforcement methods in their approach to automated training and examines the role of artificial intelligence (AI) in both creating and combating cybersecurity threats. They also discuss the future of AI in security training and provide practical steps that companies can take to enhance their cyber resilience.00:00 Introduction to SecureTalk00:34 The Importance of Security Awareness Training03:18 Craig Taylor's Journey into Cybersecurity05:25 The Evolution of Technology and AI15:30 The Role of Virtual CISOs21:48 Building CyberHoot: From Services to Product25:17 The Ineffectiveness of Shock Collars and Negative Reinforcement26:21 The Power of Positive Reinforcement in Training27:21 Challenges with Fake Email Phishing27:51 Cyberhoots' Approach to Phishing Simulations28:50 Gamification and Positive Outcomes30:26 The Anxiety Around Cybersecurity Training31:39 The Problem with Traditional Phishing Tests33:13 Emerging Best Practices in Cybersecurity38:53 The Role of AI in Phishing and Cybersecurity45:16 Future Perspectives and Rapid Content Creation48:46 Conclusion and Final Thoughts

In this episode of Secure Talk we discuss the evolution of identity management with Eric Olden, co-founder and CEO of Strata Identity. Identity Management is at the heart of secure computing practices. And the requirements placed on it are ever-growing. Get it wrong, and you will expose the ‘crown jewels’ of your business. Today, many solutions rely on cloud-based Identity Management solutions for further security. How was Identity Management born, and where is it heading?We discuss the early days of networked computing. How Eric recognized in 1995, while at Berkley, the opportunity of the Internet to break out of academic communities and become a space for business. In a moment of inspiration, he realized that the missing feature was security. To be successful a ‘web powered’ business needed to manage its users and their identities. Eric founded Securant Technologies in 1995 and developed some of the first Web Access Management products.  Securant Technologies was acquired by RSA in 2001. Eric continued to stay at the forefront of Identity Management by working on SAML, the gold standard of shared authentication.  Today, Eric is developing Strata and exploring how enterprise organizations are harmonizing multiple Identity Providers from Okta to Microsoft. Tune in to learn about the critical advancements shaping the trusted identity landscape from a leading expert and present innovator.00:00 Introduction to SecureTalk01:51 Challenges in Identity Management03:16 Introduction to Eric Olden04:33 Eric Olden's Early Experiences with Computing08:39 The Birth of Identity Management Solutions17:11 The Origin of SAML23:13 Reflections on SAML Evolution23:56 Introduction to OAuth and Identity Standards26:22 The Vision Behind Strata30:15 Challenges in Identity Management33:12 Exploring Self-Hosted Identity Solutions40:07 The Importance of Authentication and Authorization46:39 Concluding Thoughts on Identity Standards

Cybersecurity is complicated; weird acronyms, massive risks and arcane skills. How do we teach or learn about cybersecurity in human ways?In this episode of SecureTalk, host Justin Beals is joined by cybersecurity researcher Luca Viganò to discuss his innovative approach to demystifying cybersecurity concepts using fairy tales. Luca shares his passion for making cybersecurity accessible to both experts and the general public by employing storytelling techniques. Key topics include multifactor authentication, explained through 'Cinderella' and password security inspired by 'Alibaba and the 40 Thieves.' Luca's insights are based on his acclaimed article 'Cyber Security of Fairy Tales.' This episode provides a fresh perspective on engaging non-expert stakeholders and underlines the importance of a social-technical approach to cybersecurity.00:00 Introduction to SecureTalk00:34 Host's Background and Passion for Storytelling03:07 Introducing Luca Vigano04:49 Luca's Journey in Cybersecurity06:47 The Power of Storytelling in Teaching Security08:10 Fairy Tales and Cybersecurity18:43 Cinderella and Multi-Factor Authentication34:06 Alibaba and the 40 Thieves: Lessons in Security40:30 Show vs. Tell in Security Education44:39 Future Work and ConclusionArticle: Luca Viganò, The cybersecurity of fairy tales, Journal of Cybersecurity, Volume 10, Issue 1, 2024, tyae005, https://doi.org/10.1093/cybsec/tyae005

In this episode of SecureTalk, host Justin Beals speaks with Idan Plotnik, co-founder and CEO of Apiiro, about the complexities of application security and innovation. They discuss Idan's career, which began with his early interest in secure computing as an engineer for the Israeli Defence Force. Later, while at Microsoft, Idan was frustrated by the inefficiencies in current application security reviews that slowed down software delivery. Idan explains opportunities to improve the application security posture throughout the software development lifecycle, emphasizing their methods for deep code analysis and extended Software Bill of Materials (SBOMs). The conversation also covers the role of AI in security, the significance of automation, and the integration of graph data models for effectively visualizing and managing security threats.00:00 Welcome to SecureTalk00:32 Introduction to Application Security01:44 Meet Idan Plotnik02:52 Idan’s Journey in Cybersecurity04:31 Early Encounters with Computers and Security08:44 Military Service and Professional Growth12:19 Founding Apiiro and Innovations in Security14:06 Challenges in Modern Software Development15:33 Comprehensive Security Measures19:47 Understanding the Risk Landscape24:35 Understanding Risk in Software Architecture25:30 The Role of AI in Software Security26:29 Translating Code into Components27:50 The Importance of Software Inventory31:47 The Limitations of SBOMs40:02 Automation in Security Design46:00 The Power of Graph Data Models48:35 Conclusion and Final Thoughts

It’s easy to consider privacy as a technology issue, or a legal challenge. But our concepts of privacy have a lot to do with what type of community we would all like to live in. What happens when we consider privacy a right as opposed to a commodity?Join us on Secure Talk for an in-depth exploration of the complex world of privacy with esteemed sociologist and author James B. Rule. In this episode, he draws parallels between past and present institutional power. He discusses his latest book, “Taking Privacy Seriously:  How to Create the Rights We Need While We Still Have Something to Protect “where he delves into the intricacies of privacy laws, the implications of personal data commercialization, and the notion of "personal decision systems." James presents 11 practical privacy reforms, highlighting the importance of informed consent and strong data protection measures. This episode offers cybersecurity experts valuable historical context, actionable insights, and thought-provoking discussions on how to balance privacy with technological advancement. Join the conversation on how we can protect what truly matters.Join us as we examine the challenges and potential reforms related to privacy in the digital age, highlighting recent legislative successes such as California's new privacy laws. James advocates for the establishment of national institutions dedicated to promoting privacy. He also discusses the ethical dilemmas faced by technology and policy leaders in striving to find the right balance between the utility of personal data and the protection of individual privacy.This episode is essential for cybersecurity experts interested in privacy reform and the history of personal data usage.Book: “Taking Privacy Seriously: How to Create the Rights We Need While We Still Have Something to Protect” https://www.ucpress.edu/books/taking-privacy-seriously/paper00:00 Introduction to SecureTalk00:32 Exploring the Complexities of Privacy01:21 Introducing James B. Ruhle02:56 James B. Ruhle's Journey into Privacy06:55 Historical Perspectives on Privacy09:10 Modern Privacy Challenges and Solutions15:48 The Concept of Lawful Basis23:59 Personal Decision Systems26:26 Proposed Privacy Reforms36:56 Public Events and Privacy Issues42:55 Conclusion and Final Thoughts

Have you ever felt like tech fandom was turning into a cult? A tech founder ‘preached’ that they heralded a new paradigm for humanity? AI will change everything, Cryptocurrency will make you rich, the ‘Singularity’ is coming! Elon Musk, Sam Altman, Steve Jobs, Bill Gates, etc are raised up as the new messiah by thousands of worshipers. Is it really so difficult to see the tendency of the billionaire technology founders to prey on our hopes and fears?In a thought-provoking episode of Secure Talk, host Justin Beals  interviews Greg Epstein, the Humanist Chaplain at Harvard and MIT, and a New York Times bestselling author about his upcoming book, "Tech Agnostic: How Technology Became the World's Most Powerful Religion and Why It Desperately Needs a Reformation." They discuss the intricate relationship between technology, ethics, security, and human experience, challenging traditional perspectives on cybersecurity. Through engaging conversations about societal equity, community connections, and the ethical implications of technology-induced isolation, Greg and Justin shed light on the profound cultural and existential impact of technology on modern life. The discussion delves into the psychological and emotional aspects of the tech world, drawing parallels with religious structures and highlighting the need for a balance between technological engagement and ethical responsibility.Book: "Tech Agnostic: How Technology Became the World's Most Powerful Religion and Why it Desperately Needs a Reformation"https://mitpress.mit.edu/9780262049207/tech-agnostic/

My first SOC 2 audit as a Chief Technology Officer felt like performance art. Here we were, dancing to the tune of an auditor that had never built a web application, let alone a business. So many of their playbooks were repeated from other businesses and didn’t make us more secure. When we were done I was certainly glad to show off our new ‘certification’ but I wondered how I could implement great security and create value for my company.In this compelling episode of Secure Talk, host Justin interviews Bob Chaput, a seasoned CISO and cybersecurity leader with a rich background in the healthcare sector. The conversation traverses Bob’s extensive career, from his early days at GE to establishing Johnson & Johnson’s first information security program. Bob shares profound insights from his book, 'Cyber Risk Management as a Value Creator,' illustrating the shift of cybersecurity from a defensive necessity to a strategic business driver. They explore the critical role of governance, regulatory accountability, and the implementation of risk management frameworks like the NIST cybersecurity framework. Using real-world cases like Equifax’s post-breach recovery, Bob elucidates the tangible business value of robust cybersecurity measures. Learn about budgeting for cybersecurity, fostering organizational engagement, and integrating security into business operations for enhanced resilience and customer trust. This episode is a treasure trove for experts looking to transform their cybersecurity approach into a strategic advantage.Book:  Enterprise Cyber Risk Management as a Value Creator https://bobchaput.com/enterprise-cyber-risk-management-as-a-value-creator/00:00 Welcome to SecureTalk: Introduction and Host Overview00:41 The Importance of Scope in Cybersecurity02:58 Introducing Bob Chaput: Cybersecurity Expert04:45 Bob Chaput's Career Journey08:17 Enterprise Cyber Risk Management as a Value Creator12:20 The Role of Regulations and Accountability in Cybersecurity17:26 Strategic Approach to Enterprise Cyber Risk Management21:33 Risk and Opportunity Assessment in Cybersecurity26:47 Leveraging Security Practices for Business Value27:58 The Impact of Cybersecurity on Business Value28:56 Clearwater's Role in Enhancing Cybersecurity31:03 The ECRM Budget Philosophy32:59 Maxims for Effective Cyber Risk Management35:59 Building a Team Sport Culture in Cybersecurity40:47 Foundational Components of ECRM44:19 Challenges in Third-Party Risk Management49:25 Clearwater's Journey and Future Prospects

In the never-ending vortex of Silicon Valley's hype cycle, it's easy to get lost in the sea of superficial success stories and forget that true innovation often requires patience, persistence, and a willingness to disrupt the status quo – not just a fancy logo or a tweet from a billionaire CEO. Inside of the froth however, there are investors and venture capitalists that think carefully about who they are investing in, why it is a durable venture and how to create the best impact for everyone.In this episode of Secure Talk, host Justin Beals welcomes Rey Kirton from Forge Point Capital to discuss venture capital's unique role in the cybersecurity industry. Rey shares his journey from consulting to venture capital, outlining the importance of building meaningful long-term relationships with companies he invests in. He explains how Forge Point Capital develops investment theses and highlights the value of solution-based, data-driven AI applications. The conversation delves into the significance of listening to customer feedback, industry patterns, and emerging themes like edge computing and AI in cybersecurity. The episode is a must-listen for founders and investors navigating the current market landscape, offering insights into building successful business partnerships and understanding evolving technology trends.00:00 Welcome to SecureTalk00:36 Introducing Our Guest: Ray Kirton01:30 Rey Kirton's Career Journey02:25 Venture Capital Insights05:14 The Role of ForgePoint Capital06:55 Investment Strategies and Challenges17:01 AI in Cybersecurity21:45 Leveraging Proprietary Data for AI and Data Science23:19 The Rise and Fall of Blockchain and Crypto Hype28:10 Understanding Venture Capital Dynamics34:31 Future Trends in Technology and Investment37:56 Advice for Aspiring Founders39:09 The Importance of Customer Feedback42:47 Building Strong Investor Relationships